remcos | 876-87-0x0000000000400000-0x0000000000480000-memory[.]dmp

General

Target

876-87-0x0000000000400000-0x0000000000480000-memory.dmp
Size

512KB
MD5

ef448e76e34231b2d9fb3fc0c577b760
SHA1

2694f7b872ba34e05684672b7d2f06088c0b3fdc
SHA256

acb092009ba58888ee441cb0f66fe1a77a1b3dea48dad0c5cec65abb9a5e3ecc
SHA512

ec385cf12e2c36b7c766ac3f5d1f691c8b00726d0c17658febe057465c7324d8c4ba969b9367c08b10bfd3c217424b7c65c766e5c359d32a9380cc0ca4f26360
SSDEEP

6144:tXSTGAOFCBf7tcJLsfuRpAKSC2eKCmB/tvPNT/kC+xiGsAOZZ0QXLcASRq:tXnQpc9IuLAKN2eKCStvVgs/Z0rRq

Score

10^/10

Family

remcos

Botnet

SixthClients

C2

top.not2beabused01.xyz:1558

sub.not2beabused02.xyz:1558

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
appsync.exe
copy_folder
Appsync
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Appsync
keylog_path
%AppData%
mouse_option
false
mutex
Appsync-TYGH55
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Appsync
take_screenshot_option
true
take_screenshot_time
55
take_screenshot_title
mail;webmail;crypto;btc;ethereum;bitcoin;eth;outlook;foxmail;bank;email;compose;