Gamaredon GammaSteel, Argamal RAT, and Remus Stealer: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Gamaredon GammaSteel Persistence Registry Key
description: Detects Gamaredon group activity via registry modifications in HKCU\Printers used for payload storage.
references:
    - https://blog.sekoia.io/fsbs-matryoshka-3-3-gamaredons-gifts-that-keeps-unpacking-gammasteel/
author: Security Arsenal
date: 2026/06/05
status: stable
logsource:
    product: windows
    category: registry_set
    definition: 'Requirements: Sysmon config with Registry logging enabled'
detection:
    selection:
        TargetObject|contains: 'Printers'
        TargetObject|contains: 'HKCU\Software'
    condition: selection
falsepositives:
    - Unlikely (Legitimate printer drivers do not write complex payload structures to user hives)
level: critical
tags:
    - attack.persistence
    - attack.defense_evasion
    - gamaredon
---
title: Suspicious COM Hijacking via Windows Color System
description: Detects potential Argamal malware activity via COM hijacking targeting the Windows Color System Calibration Loader.
references:
    - https://securelist.com/argamal-rat-distributed-with-hentai-games/119999/
author: Security Arsenal
date: 2026/06/05
status: stable
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains: 'CLSID'
        TargetObject|contains: 'InprocServer32'
        TargetObject|contains: 'mscms'
        Details|contains: '.dll'
    filter:
        Details|contains: 'C:\\Windows\\system32\\mscms.dll'
    condition: selection and not filter
falsepositives:
    - Low
level: high
tags:
    - attack.persistence
    - attack.hijack_execution_flow
    - argamal
---
title: Traffic Distribution System (TDS) Network Connections
description: Detects network connections to known TDS infrastructure used for distributing RemusStealer and SessionGate.
references:
    - https://research.checkpoint.com/2026/impersonation-click-hijacking-and-tds-inside-a-malware-distribution-ecosystem/
author: Security Arsenal
date: 2026/06/05
status: stable
logsource:
    product: windows
    category: network_connection
detection:
    selection_ip:
        DestinationIp:
            - '194.150.220.218'
            - '217.156.122.75'
            - '165.22.170.129'
    selection_domain:
        DestinationHostname|contains:
            - 'guiformet.com'
            - 'forestoaker.com'
            - 'justsstop.ru'
            - 'maxdatahost1.cyou'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: critical
tags:
    - attack.command_and_control
    - attack.initial_access
    - tds

// Hunt for Gamaredon Registry Persistence
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where ActionType == "RegistryValueSet"
| where RegistryKey has @"HKCU\Software" and RegistryKey has @"Printers"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData

// Hunt for Malware Distribution Network Connections
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("guiformet.com", "forestoaker.com", "justsstop.ru", "maxdatahost1.cyou") 
   or RemoteIP in ("194.150.220.218", "217.156.122.75", "165.22.170.129")
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort

# Hunt for Gamaredon GammaSteel Registry Artifacts
# Checks HKCU\Printers for suspicious values

$UserHives = Get-ChildItem "Registry::HKEY_USERS"
$SuspiciousKeys = @()

foreach ($Hive in $UserHives.Name) {
    $PrintersPath = "$Hive\Software\Microsoft\Windows NT\CurrentVersion\Printers"
    if (Test-Path $PrintersPath) {
        $Keys = Get-Item $PrintersPath -ErrorAction SilentlyContinue
        if ($Keys -and $Keys.ValueCount -gt 0) {
            # Gamaredon stores payload functions here, excessive values or binary data is suspicious
            foreach ($Val in $Keys.GetValueNames()) {
                $ValData = $Keys.GetValue($Val)
                if ($ValData -is [byte[]]) {
                    $SuspiciousKeys += [PSCustomObject]@{
                        UserHive = $Hive
                        Key = $PrintersPath
                        ValueName = $Val
                        DataSize = $ValData.Length
                        Status = "Suspicious Binary Data"
                    }
                }
            }
        }
    }
}

if ($SuspiciousKeys.Count -gt 0) {
    Write-Host "[!] Potential Gamaredon GammaSteel Artifacts Detected:" -ForegroundColor Red
    $SuspiciousKeys | Format-Table -AutoSize
} else {
    Write-Host "[-] No GammaSteel registry artifacts found." -ForegroundColor Green
}

# Hunt for Argamal COM Hijack (mscms.dll)
# Checking HKCU\Software\Classes\CLSID for InprocServer32 changes
$ClsidPath = "Registry::HKEY_CURRENT_USER\Software\Classes\CLSID"
if (Test-Path $ClsidPath) {
    Get-ChildItem -Path $ClsidPath -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
        $InprocPath = "$($_.PSPath)\InprocServer32"
        if (Test-Path $InprocPath) {
            $DefaultVal = (Get-Item $InprocPath).GetValue("")
            # Legitimate is usually C:\Windows\system32\mscms.dll
            if ($DefaultVal -and $DefaultVal -notlike "C:\Windows\system32\*") {
                Write-Host "[!] Suspicious COM Hijack found: $InprocPath -> $DefaultVal" -ForegroundColor Yellow
            }
        }
    }
}