Remcos RAT Audio/Webcam Recording with Remcos_Mutex_Inj and C2 to 62.102.148.212
Detects the presence of Remcos RAT by correlating a specific mutex (Remcos_Mutex_Inj) indicative of active malicious processes with an outbound network connection to a known command-and-control (C2) IP address (62.102.148.212) on port 37393. This combination is characteristic of Remcos RAT operations used for unauthorized audio and webcam surveillance.
YARA-L
