Remcos RAT Screenshot Capture to AppData\Roaming\Screenshots

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects periodic screen captures being written to the AppData\Roaming\Screenshots directory with specific timestamped naming patterns (time_YYYYMMDD_ or wnd_YYYYMMDD_) often used by Remcos RAT to exfiltrate user activity.