Remcos RAT Loader Resource Extraction

Ankit Mehta@Secvyn

•updated Jun 23, 2026•1•0•7

Detects process command lines containing keywords associated with resource extraction, decryption, or decompression, specifically when initiated by 'GST*.com' or involving 'Optimax.dll'. This behavior is indicative of a Remcos RAT loader attempting to unpack or prepare its payload.