Argamal RAT Windows Color System COM Hijack

Tim Peck@timpeck

•updated Jun 3, 2026•0•0•8

Detects COM hijacking of the Windows Color System Calibration Loader CLSID ({B210D694-C8DF-490D-9576-9E20CDBC20BD}). The Argamal RAT abuses this specific CLSID by modifying the InprocServer32 key in the user hive to establish startup persistence tied to user login via a default Windows scheduled task.