.NET Reflection Usage for Obfuscation by Remcos Loader

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•0

Detects the use of .NET Reflection methods (System.Reflection, Activator.CreateInstance, InvokeMember, MethodInfo) by processes named 'GST*.com' or 'Optimax.dll'. This behavior is indicative of obfuscation techniques often employed by malware, specifically associated with the Remcos RAT loader in this context.