Argamal RAT Stage 1 COM Hijack

Duo Tech@duotech

•updated Jun 3, 2026•0•0•12

Detects registry modifications to the specific CLSID {722D0F89-B69C-4700-AE8C-4A44350E4876} utilized by the Argamal RAT's Stage 1 PowerShell script. This establishes initial persistence to later download and decrypt the final payload.