briannacorporation.com: a business website listed for GuLoader and Remcos RAT files, and what to do on Windows
briannacorporation.com is a web address that URLhaus lists four times, on 9 and 12 October 2026, for encrypted or encoded files tagged GuLoader and RemcosRAT, a loader and a remote access trojan for Windows. The front page answers like an ordinary business site, so the files may sit on a site that was broken into; that is our reading, not something a report says.
If you only saw the name in a log or a warning, nothing is proven; if something on your PC may have fetched these files, treat the PC as watched, change passwords from another device, then scan and clean or reset Windows.
Facts checked October 12, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If a script, loader or program that downloads .bin, .xsn or .cur files from briannacorporation.com keeps coming back after uninstalling, a scan can find what reinstalls it.
Do it yourself · free Remove briannacorporation.com (GuLoader, Remcos RAT) yourself 5 steps, about 15 minutes, no software needed.
Start the steps
Briannacorporation.com (GuLoader, Remcos RAT): summary
| Type | A malware hosting address: URLhaus tags its four files GuLoader (a downloader) and RemcosRAT (a remote access trojan for Windows) |
|---|---|
| Risk | High if a loader on your PC fetched its files: keystrokes, passwords, screen, camera and files may be seen or taken. Low if you only saw the name |
| Symptoms | Often none. Unknown startup entries in the Run or RunOnce keys and a Defender detection called Backdoor:Win32/Remcos are the signs in the sources |
| How to get rid of it | Change passwords from another device, run Microsoft Defender Offline, remove the startup entries, and reset Windows if you are not sure |
| Our check (12 October 2026) | One plain request from our server to the home page: HTTP 200, title Brianna Survey Solutions. A quiet front page clears nothing; the danger rating comes from URLhaus |
| Running since / first seen | Domain registered 8 July 2016; first files reported 9 October 2026 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 9 more facts
| Platform | Windows. Nothing we read says Mac or phones are affected |
|---|---|
| Detection names | No detection name is known for the four files on this server, because we did not open them. For Remcos in general Microsoft uses Backdoor:Win32/Remcos |
| Name | Briannacorporation.com |
| Domain registered | 8 July 2016 |
| Evidence | 4 write-ups by security sites; details still limited |
| First seen | 9 October 2026 |
| Distribution | Typically fake installers, cracked programs, e-mail attachments, fake "verify you are human" pages and ads for popular apps |
| Damage | Installs other malware, often several programs at once |
| Facts checked | 12 October 2026 |
Facts checked on 12 October 2026 against the URLhaus data for briannacorporation.com held in our database, RDAP (read 10 October 2026), one plain request from our server, and the pages of MITRE ATT&CK and Microsoft listed below. We did not download the files and we infected no PC; the removal steps follow Microsoft's pages and were not tried on a live infection. The owner advice is our general guidance.
What briannacorporation.com is, and what we know about it
briannacorporation.com is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where malware files were served. Its home page answers like a normal small business site, which is a common picture when a real site has been misused. We found no public write-up of this address, so what follows is what URLhaus shows, what our server saw, and what MITRE and Microsoft publish about the two malware names in the tags.
- 1
What URLhaus lists
Four file addresses on briannacorporation.com, all on the secure https port. Two are in a folder called cap (Chored.cur and eZlHodoWq46.bin), added on 9 October 2026, and two are in a folder called manager (Equiradial.xsn and MpcZsNiyLyPAfar30.bin), added on 12 October 2026. All four are marked online, carry the threat label malware_download and were reported by abuse_ch.
- 2
What the tags mean
GuLoader is the name of a downloader, a first program whose job is to fetch another program. RemcosRAT is the name of a remote access trojan, a program that lets a stranger control a computer. rat means the same thing. encrypted and Encoded say the files are not plain programs but scrambled data. ascii says the .xsn and .cur files are text. The tags describe what abuse.ch saw; we did not download the files.
- 3
What the file names suggest
The endings .cur (a mouse cursor), .xsn and .bin have nothing to do with a business website. Random looking names such as eZlHodoWq46 and MpcZsNiyLyPAfar30 are typical for files made only to be fetched by a program. A person has no reason to open them. That is our reading of the names, not a statement from any report.
- 4
What this means for you
If you only saw the name in a firewall log, an antivirus alert or a blocked request, you are not infected by that alone. The risk is for a Windows PC where a first program already ran and went to fetch one of these files. Visitors to the home page are not the target of the files.
- Kind of threat
- A web server handing out encrypted or encoded files tagged GuLoader (a downloader) and RemcosRAT (a remote access trojan for Windows)
- Where the files are
- hxxps://briannacorporation[.]com/manager/ and hxxps://briannacorporation[.]com/cap/, files ending .bin, .xsn and .cur
- Domain registered
- 8 July 2016, registrar eNom, LLC, status client transfer prohibited (RDAP, read 10 October 2026)
- URLhaus entries
- 4 file addresses, added 9 October (2) and 12 October 2026 (2); all 4 online when we read our copy of the data
- Home page
- Answered with HTTP 200 and the title Brianna Survey Solutions on 12 October 2026 (one plain request from our server)
- Platform
- Windows. MITRE lists both Remcos and GuLoader as Windows software. Nothing we read says Mac, iPhone or Android are affected
What briannacorporation.com (GuLoader, Remcos RAT) does on an infected PC
What we checked on 12 October 2026, and what we could not
Our check was a plain request from our server to the home page: no browser, no clicks, no scrolling. It got a normal answer. That clears nothing, because the reported files are in two folders that a plain look at the front page would never touch.
Our plain request, 12 October 2026
- The home page answersHTTP status 200, no redirect, page title Brianna Survey Solutions, server header BitNinja-WafPro. A BitNinja header points to a web application firewall in front of the site; we do not know what it was set to block.
- Why a quiet home page is not a clean resultA site can serve ordinary pages to a visitor and malware files only to the programs that ask for an exact address. Malware servers also filter by country or by who asks. Our one request from one server proves nothing about other visitors.
- Notification requestNot seen on this one request. Our plain request cannot run scripts, so this says little.
- URLhaus listingFour file addresses tagged GuLoader and RemcosRAT, all online in our copy of the data on 12 October 2026.
- Downloads and the files themselvesWe did not download any file and did not open the folders. We cannot tell you what the files contain or which Remcos build they carry.
Dangerous: do not fetch these files Our check was one plain request and it proves nothing either way. The danger rating comes from the four URLhaus reports and their tags, not from our visit. Do not request files from the two folders and do not run anything that does.
What happened to briannacorporation.com, from registration to our check
The domain is more than ten years old, and the reports are all from the last four days before our check. The dates come from RDAP and from the URLhaus data we hold; times are UTC.
8 July 2016
The domain is registered
RDAP shows briannacorporation.com registered on 8 July 2016 through eNom, LLC. The record carries the status client transfer prohibited, which is a lock against moving the domain to another registrar. It says nothing about who runs the site now.
9 October 2026
Two files in the cap folder are reported
At about 18:29 UTC abuse.ch adds Chored.cur and eZlHodoWq46.bin. Both are tagged GuLoader, rat and RemcosRAT. The .cur file is also tagged ascii and Encoded; the .bin file is tagged encrypted.
12 October 2026
Two files in the manager folder, and our check
At about 07:29 UTC abuse.ch adds Equiradial.xsn and MpcZsNiyLyPAfar30.bin with the same family tags. All four files are still marked online. The same day our plain request to the home page returns a normal page.
The dates we know for briannacorporation.com: registration from RDAP and the two report batches from URLhaus data held by us.
What the pattern suggests, and what it does not: two batches three days apart, each with one scrambled .bin file and one text file in a separate folder, look like an operator who prepares fresh files and moves on. That is our reading of the dates and names. No report says how the files got onto this server, and we do not know who runs the site.
How a file on a site like this reaches a Windows PC
A scrambled file on a web server cannot hurt you by sitting there or by being listed. It works only when a program that is already running on a PC asks for it, decodes it and starts what is inside. We did not see the files; the order below is how MITRE describes GuLoader and how the tags fit it.
- 1
A first program is already running
MITRE says GuLoader has been used since at least December 2019 and reaches PCs through spearphishing links that lead to malicious documents, and through Word documents with macros that fetch the GuLoader program. So the chain starts with a document or a link a person opened.
- 2
It fetches a file over HTTP
MITRE lists the ability to use HTTP to retrieve further binaries and to download malware from Google Drive. A site such as this one is simply another place to host the next piece.
- 3
The file is data, not a program
The URLhaus tags encrypted and Encoded say the files are scrambled. The loader unscrambles them in memory, so a scanner that only reads files on the disk sees nothing that looks like a program. How exactly these files are encoded is not confirmed by us.
- 4
It runs inside another process
MITRE says GuLoader can inject shellcode into a donor process started in a suspended state, and names RegAsm as a donor it used before. In Task Manager the activity then carries a trusted Windows name.
- 5
Remcos connects to its controller
From then on a person elsewhere can use the PC through Remcos. The next sections list what the sources say it does.
MITRE also says GuLoader checks for virtual machines and sandboxes and for debuggers, and can delete its own program from the Temp folder under AppData. That is why a clean result after the fact is weak evidence.
What Remcos and GuLoader are
Remcos is sold as remote control software and is used by criminals; GuLoader is a downloader that brings such tools in. The sources agree on what they do and differ in the details of each campaign.
| Question | What the sources say | Source |
|---|---|---|
| What is Remcos? | A closed source tool marketed as remote control and surveillance software by a company called Breaking Security, observed in malware campaigns. Platform: Windows | MITRE ATT&CK S0332, modified 23 April 2026 |
| What is GuLoader? | A Windows downloader that since at least December 2019 has delivered remote administration tools. MITRE names NETWIRE, Agent Tesla, NanoCore, FormBook and Parallax RAT on its page | MITRE ATT&CK S0561, modified 25 April 2025 |
| How does Remcos stay? | A value in the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run (MITRE). Microsoft describes one sample dropping a script in a temp folder, copying itself to other folders and creating a registry key under HKEY_CURRENT_USER\SOFTWARE named Remcos | MITRE; Microsoft |
| How does GuLoader stay? | Through the RunOnce registry key under HKCU, and it can delete its own executable from AppData\Local\Temp | MITRE |
| How does Remcos hide? | Checks for Sandboxie and VMware, injects into other processes, encrypts its traffic with TLS and uses dynamic DNS domains | MITRE |
| Who uses Remcos? | MITRE names Gorgon Group, Gamaredon Group, LazyScripter and APT-C-36 (Blind Eagle). Many other users are not named there | MITRE |
| Which Microsoft name? | Backdoor:Win32/Remcos. Microsoft says there are multiple variants with different behaviours and that its analysis covers one sample | Microsoft Security Intelligence |
| Which build is this site's? | Not known. URLhaus gives only the tag RemcosRAT; we did not open the files | Not available |
What briannacorporation.com (GuLoader, Remcos RAT) can steal or download
What Remcos can take from a Windows PC
A remote access trojan gives a person a seat at your computer, so the list below is what such a person can do, not what one build does on its own. Each item is named by MITRE or Microsoft; no single report lists every build.
Reported as possible
- Every key you type
- Screenshots of your screen
- Your webcam pictures
- Audio from the microphone
- Clipboard contents, which can be read and changed
- Passwords
- Files uploaded, downloaded, zipped and deleted
- Commands run, and VBS, JavaScript and Python scripts
- Registry read and changed
- Your PC used as a SOCKS5 proxy
- Saved browser cookies and logins cleared
| Data | Detail | Source |
|---|---|---|
| Keystrokes and screen | A keylogging command and automated screenshots | MITRE; Microsoft |
| Camera and microphone | Webcam pictures and audio capture | MITRE; Microsoft |
| Clipboard | Stealing and modifying clipboard data. For a person copying a payment address, a changed clipboard is the danger | MITRE |
| Files | Upload, download, zip for taking, delete | MITRE; Microsoft |
| Control | Remote command line, script execution, ending or suspending processes, restart or shutdown, bypassing user account control | MITRE |
| Proxy | Infected hosts used as SOCKS5 proxies | MITRE |
What this can cost you
Reading the site or seeing its name costs nothing. The risks below apply to a Windows PC where a first program fetched one of these files and Remcos then ran.
- High
Passwords and accounts
A keylogger records what you type into every site, including the new passwords you set. Changing passwords from the infected PC does not help; the person watching sees the new ones too.
- High
Someone using your PC live
A remote access trojan is not a one off theft. MITRE lists remote commands and script execution, so the controller can come back and act while you are signed in.
- High
Money and crypto
Clipboard changes and screen capture can be used against payments and wallets. Crypto sent from a wallet that was taken cannot be reversed.
- Medium
Your files, camera and microphone
Microsoft and MITRE name webcam pictures, audio and file transfer. Private documents and images on the PC are exposed.
- Medium
More malware on the same PC
GuLoader exists to bring in other tools, so a PC that fetched one of these files may have received more than one program.
- Low
Nothing, if you only saw the name
A name in a block list, a log or a warning is not an infection.
What you may notice, and what you may not
Remote access trojans are built to be quiet. The signs below come from the sources and from what they imply; none is certain, and most victims notice nothing.
| Sign | What the reports show |
|---|---|
| A startup entry you did not make | MITRE says Remcos adds a value to the HKCU Run key and GuLoader uses the RunOnce key. Entries there start with your sign in |
| A registry key or mutex named Remcos | Microsoft describes a key under HKEY_CURRENT_USER\SOFTWARE and a mutex with Remcos in the name for the sample it analysed. Other builds may use other names |
| A Defender detection | Microsoft's name is Backdoor:Win32/Remcos. A detection with that name is a reason to act, not a reason to relax once it is removed |
| Camera light on, wallpaper changed, odd windows | MITRE lists webcam use and changing the desktop wallpaper among Remcos functions. This follows from the feature list; it is our reading, not a quote about this site |
| Accounts you did not touch | Logins from new places, password reset emails and messages sent from your accounts. This follows from stolen logins |
| Nothing at all | Stealth is the point of a loader that decodes in memory and removes its own file |
How to check the PC for briannacorporation.com (GuLoader, Remcos RAT)
Who can meet this, and how a PC ends up asking for these files
Nobody visits briannacorporation.com to get these files. The request comes from a program, so the real question is how that program got on the PC. We cannot say for this server; the routes below are the ones MITRE gives for GuLoader and Remcos.
- 1
A document that asks you to enable content
MITRE describes Word documents with embedded macros that fetch the GuLoader program, and Excel attachments used to deliver Remcos. Opening the file and clicking to enable editing or content is what starts it.
- 2
A link in a message
MITRE describes spearphishing links that lead to malicious documents. The link may point to a service you trust, such as a file sharing site, and MITRE says GuLoader can download from Google Drive.
- 3
A shortcut file
A reference in MITRE's Remcos entry is titled as a campaign abusing LNK shortcut files to spread Remcos. A shortcut that looks like a document but is not one is a way to run a script.
- 4
A visitor to the site itself
We found no report that visiting the home page infects anyone. If you are the visitor who just landed on the business site, the Windows steps below are for a PC that fetched the files, not for a PC that only showed the page.
If you own or run briannacorporation.com
The site answers like a real company page, and malware files in folders named cap and manager that have nothing to do with it are what a misused site looks like. We do not know that this is the case here. If the site is yours, treat the listing as a warning that someone else can write files to it. These steps are our general advice, not a procedure from a source we read.
- 1
Look at the two folders
Ask your host or developer to list the folders /manager and /cap and the files Chored.cur, eZlHodoWq46.bin, Equiradial.xsn and MpcZsNiyLyPAfar30.bin. Keep a copy for the investigation, then remove them. If you made none of them, someone else put them there.
- 2
Find how they got in
The usual doors are an outdated content management system or plugin, a stolen hosting or FTP password, or a weak admin login. Check the access logs around 9 and 12 October 2026 (UTC) for uploads and logins you do not recognise. We do not know which door was used here.
- 3
Change every secret
Change the hosting, FTP, database and admin passwords from a clean computer, and turn on two step sign in where the host offers it. Remove accounts you do not know.
- 4
Clean and update
Restore the site from a backup made before the first odd file, or have your host scan and clean it. Update the system and every plugin. Remove software you no longer use.
- 5
Tell the reporter once it is clean
URLhaus entries change to offline when the files stop answering. Check the status yourself afterwards. A listing does not vanish by itself while the files are still served.
Check your PC before you delete anything
Start with the question that matters: did something on this PC contact briannacorporation.com, or did you open an unexpected document, shortcut or script? If you saw the name in a log from your own network, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.
While you check, stop using the PC for banking, email, work or crypto. Disconnecting the network is the safest first move.
- 1
Disconnect first
Turn off Wi-Fi or unplug the network cable. A remote access trojan needs the connection to be used.
- 2
Find which device asked for the address
If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question, not every device on the network.
- 3
Open Protection history
In Windows Security > Virus & threat protection > Protection history, look for a detection called Backdoor:Win32/Remcos or for anything blocked or quarantined around the time of first contact. Microsoft says the results of an offline scan also appear there. Windows 11 24H2 and 25H2 show it as in the picture.
- 4
Look at startup entries
Open Settings > Apps > Startup and look for names you did not install. MITRE names the registry keys HKCU\Software\Microsoft\Windows\CurrentVersion\Run for Remcos and RunOnce for GuLoader. Do not delete yet; write the name and the program it runs.
- 5
Look at running processes
Open Task Manager and look for RegAsm.exe running with no reason, or any process with steady network use you cannot explain. MITRE names RegAsm as a donor process GuLoader used before. It is a real Windows program, so its presence is not proof and its absence does not clear the PC.
- 6
Check your accounts from another device
Look at the sign in activity of your email, bank and exchange accounts, and at crypto balances. This is quicker than any file check.
- 7
A scan helps, but it does not clear the PC
A scan with Microsoft Defender or another product can find known files. Treat a clean result the way you treat a clean site test: one data point. We did not infect a PC, so the order of this plan is our judgement from Microsoft's and MITRE's pages, not a tested result.
How to remove briannacorporation.com (GuLoader, Remcos RAT)
How to remove briannacorporation.com
A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.
Step 1: Delete scheduled tasks that bring it back
Programs like briannacorporation.com add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 2: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in
%AppData%or%Temp%deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.
Press Windows + R, type
%LocalAppData%and press Enter, then do the same for%AppData%and %ProgramData%, and look for folders named after briannacorporation.com, its publisher or created on the day the problem started. Delete those folders, and check C:\Program Files and C:\Program Files (x86) too.If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
A scan finds the parts of briannacorporation.com that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Briannacorporation.com can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.
Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.
Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
If you use a Mac, an iPhone or an Android phone
The tags and every source we read describe a Windows threat. We found nothing that says the files on briannacorporation.com affect anything else.
| Your device | What we know | What to do |
|---|---|---|
| Mac | MITRE lists Remcos and GuLoader as Windows software. The documents and registry keys in the reports are Windows things | Nothing to remove for this threat. Do not follow the Windows steps on a Mac |
| iPhone or iPad | No source we read describes these files on iOS | Nothing to remove. If you typed passwords on a page you do not trust, change them |
| Android | No source mentions it | Nothing to remove for this threat; change passwords if you entered any |
After removal: passwords, accounts and prevention
After a clean PC: protect what was taken
The PC is one half. The other half is everything you typed or stored on it while the trojan was there. The order matters: another device first, then the PC.
- 1
Change passwords from a clean device
Use a phone or another computer you trust. Start with email, because it resets everything else, then bank, work, cloud storage and crypto. Anything typed on the PC while it was watched is already known.
- 2
Sign out other sessions and turn on two step sign in
In each important account, sign out of all devices and turn on two step sign in if it is offered, so a password alone does not let anyone in. Update the recovery email and phone while you are there.
- 3
Move crypto first if a wallet was on the PC
If a seed phrase or wallet file was ever on the PC, assume it is known. Create a new wallet and recovery phrase on a clean device and move the funds there.
- 4
Run Microsoft Defender Offline
Microsoft says to open Windows Security > Virus & threat protection > Scan options, choose Microsoft Defender Offline scan and select Scan now. Save your work first: Windows signs you out and restarts, and the scan takes about 15 minutes. If BitLocker is on, Microsoft says to suspend it first or the restart may ask for the recovery key. Results are under Protection history. It applies to x64 Windows 11 and to Windows 10; not to ARM versions.
- 5
Remove what the check found, with care
If the Startup list or the Run key showed an entry that you can tie to the malware, remove it after the scan. If you cannot tell, do not guess: the safe answer is the reset below.
- 6
If you are not sure, reset Windows
Microsoft's recovery page says Reset this PC can be started from Settings or WinRE; the recovery options are under Settings > System > Recovery. Keep my files removes apps and settings but keeps personal files; Remove everything removes files, apps and settings. For a PC that may have been under remote control, the full wipe is the answer that does not depend on finding every piece. Microsoft calls it the most disruptive option and says to back up first and, with BitLocker, keep the recovery key ready.
- 7
Restore only documents by hand
Copy back documents and photos, not programs, and not a full system image from after the first contact. Install apps from their makers' own sites.
- 8
Rebuild logins in a password manager
Do not let the browser save passwords again on a PC that was watched. Use a password manager and an authenticator app or security key for two step sign in.
- 9
Watch your money and your accounts
Check card statements and exchange logs for a few weeks and turn on alerts. If personal data was stolen, report it to your national consumer or identity theft service.
- 10
Tell the people you message
If your accounts were used to send links, tell your contacts not to open them.
Keep a PC out of this kind of chain
The file on the server is the late part of the chain. The sources we read start earlier, with a document, a link or a shortcut that a person opened.
Do
- Treat an unexpected document that asks you to enable editing, content or macros as an attack, and close it. MITRE describes GuLoader campaigns that began exactly so.
- Keep Windows and Microsoft Defender updated; Microsoft advises periodic scans and updated antivirus.
- Show file endings in File Explorer so a shortcut or script posing as a document is visible.
- Get programs from their makers' own sites or from the Microsoft Store.
- Use a password manager and two step sign in, so one stolen password is not enough.
- Keep a backup of documents on a disk that you unplug.
Don't
- Do not open attachments or links from senders you do not expect, even when they look like an invoice or an order.
- Do not run cracked programs or bundles from sites that promise free versions of paid software.
- Do not assume a respectable looking company site is safe to download from because its home page loads.
- Do not change your passwords on the PC you suspect.
- Do not rely on a quiet scan to say that you are safe.
Questions about briannacorporation.com (GuLoader, Remcos RAT)
What is briannacorporation.com?
It is a web address that URLhaus, the malware tracking project run by abuse.ch, lists for four files tagged GuLoader and RemcosRAT. Two were reported on 9 October 2026 and two on 12 October 2026.
The home page answered our plain request like an ordinary business site titled Brianna Survey Solutions, so the files may sit on a site that someone else misused. That is our reading. We did not download the files, so what they contain is not confirmed by us.
Is briannacorporation.com safe to open?
Do not request files from the folders /manager and /cap, and do not run anything that does.
Our plain request to the home page worked normally, which proves little: a site can show ordinary pages to visitors and serve malware only to programs that ask for an exact address. The danger rating comes from the four URLhaus reports and their tags, not from our visit.
Is briannacorporation.com a scam or a virus?
It is not a virus on your PC, and we cannot say who runs the site or whether the business is real. What is confirmed is the listing: URLhaus shows four malware download files there, tagged GuLoader and RemcosRAT.
We found no source that calls the company itself a scam, so we do not. Treat the files as dangerous and the owner's role as unknown.
What are GuLoader and Remcos?
GuLoader is a Windows downloader. MITRE says it has been used since at least December 2019 to bring in remote administration tools. Remcos is a remote access tool sold as remote control software and used by criminals.
MITRE and Microsoft list keylogging, screenshots, webcam and microphone use, file transfer and remote commands. A loader fetches the tool, and the tool lets a person control the PC.
I saw briannacorporation.com in my firewall or DNS log. Am I infected?
Not necessarily, and the name alone proves nothing. It does mean that a device on your network asked for it, and a person does not usually do that by hand. Find which device it was, disconnect it, and run the checks on this page:
- Protection history
- Startup apps
- the Run keys
- a Microsoft Defender Offline scan
Do the account changes from another device.
How do I remove Remcos from Windows?
Change your passwords from another device first. Then run a Microsoft Defender Offline scan (Windows Security, Virus and threat protection, Scan options), check Startup apps and the Run key for entries you did not make, and remove the ones you can tie to the malware.
If you are not sure, reset Windows with Remove everything and restore only documents. We followed Microsoft's pages and did not test the steps on an infected PC.
What can Remcos see and take?
According to MITRE and Microsoft:
- your keystrokes
- screenshots
- webcam pictures
- microphone audio
- clipboard data
- files it uploads
- downloads or deletes
- commands the controller runs
MITRE also lists using the PC as a proxy. The person in control decides what to take and can come back later. Treat every password, every signed in session and every wallet on the PC as known, and change them from another device.
Does briannacorporation.com affect Mac, iPhone or Android?
We found nothing that says so. MITRE lists both Remcos and GuLoader as Windows software, and the documents and registry keys in the reports are Windows things.
On a Mac, iPhone or Android phone there is nothing to remove for this threat. If you typed a password on a page you do not trust, change it.
I own briannacorporation.com. What should I do?
Have your host list the folders /manager and /cap and keep a copy of the four files, then remove them.
Check the access logs around 9 and 12 October 2026 for uploads and logins you do not know, change the hosting, FTP, database and admin passwords from a clean computer, update the system and plugins, and restore from a backup made before the first odd file. This is our general advice, not a procedure from a source we read.
Will Fortect remove briannacorporation.com?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For briannacorporation.com, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- MITRE ATT&CK: Remcos, S0332 (modified 23 April 2026) (read October 12, 2026)
- MITRE ATT&CK: GuLoader, S0561 (modified 25 April 2025) (read October 12, 2026)
- Microsoft Security Intelligence: Backdoor:Win32/Remcos (read October 12, 2026)
- Microsoft Learn: Microsoft Defender Offline scan in Windows (updated 25 August 2026) (read October 12, 2026)
- Microsoft Support: Recovery options in Windows (Reset this PC) (read October 12, 2026)