Remcos RAT (SmartApeSG)

Daniel Jeremiah@daniyyell

•updated Feb 20, 2026•0•29

Detects Remcos RAT payload drop - zip archive saved with .pdf extension (2120206.pdf) in user Temp. Requires known SHA256 to avoid false positives from arbitrary .pdf files; use field name your backend provides (e.g. FileHash, Hash, SHA256).