Remcos RAT (SmartApeSG) - Registry Run Key Shotcut Persistence

Daniel Jeremiah@daniyyell

•updated Feb 14, 2026•1•0•40

Detects Remcos RAT persistence via HKCU Run key "Shotcut video editor" pointing to shotcut.exe under AppData\Local\2120206 (DLL sideloading). All five strings required to avoid false positives.