remcos | 460-67-0x0000000000400000-0x0000000000480000-memory[.]dmp

General

Target

460-67-0x0000000000400000-0x0000000000480000-memory.dmp
Size

512KB
MD5

039a297836783c2eafb00a8ebb4c547b
SHA1

4e1aaba1025cd94114af4c3f4a6b24df81b1ae58
SHA256

8df6a94b1291e1a30e8b2014ee430d6f52fe215d455686f0a610bb34092f2dc7
SHA512

e63c3156bc5cb72f894310f85565532cba95f3cd667d8603165a75104b37f409c4d0f4144fbbb34e904c9ab6c1503949a2fad136ac3c06542d99ae03bd3f6cff
SSDEEP

6144:mGqPd7rxgdfHD0Tnt5eh+4CwineHvWyBKxrw/5ttwAMS6NX0sAOZZ7QX3c0ARq:mGAxQj0bTe04CLneHvW9rwbrs/Z71Rq

Score

10^/10

Family

remcos

Botnet

SecondClients

C2

top.not2beabused01.xyz:1558

sub.not2beabused02.xyz:1558

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
appsync.exe
copy_folder
Appsync
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Appsync
keylog_path
%AppData%
mouse_option
false
mutex
Appsync-PKBX7H
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Appsync
take_screenshot_option
true
take_screenshot_time
55
take_screenshot_title
mail;webmail;crypto;btc;ethereum;bitcoin;eth;outlook;foxmail;bank;email;compose;