Gst Remcos RAT Loader File Activity

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•0

Detects file events related to potential Remcos RAT loader activity, specifically looking for files with names starting with 'GST' or containing 'GST_' and within a specific size range (1KB to 1000KB). This pattern is indicative of a known Remcos RAT loader.