Suspicious Bitsadmin Payload Download For Argamal RAT

Duo Tech@duotech

•updated Jun 3, 2026•0•0•10

Detects the use of bitsadmin.exe to download the Argamal RAT encrypted payload file (zaesdl.dat), a technique utilized in the Stage 2 delivery script.