Gst Remcos RAT Loader - Archive File Extraction

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•0

Detects the creation of archive files (ZIP, RAR, 7Z) or executables with specific naming conventions (GST_, Debit_, Invoice_, NEFT_, RTGS_) often associated with Remcos RAT loaders. This rule focuses on the initial file creation event on a device.