All Detections

Remcos RAT (SmartApeSG) - Shotcut

avatar
Daniel Jeremiah@daniyyell
updated Feb 20, 2026027

Detects Remcos RAT execution via shotcut.exe running from AppData\Local\2120206 (DLL sideloading). Requires full path to avoid false positives from other Shotcut installs.

Sigma