Overview

overview

10

Static

static

119.exe

windows7_x64

10

119.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    119.exe

  • Size

    1.9MB

  • Sample

    210929-rly68afccl

  • MD5

    c9c0c09e7b2c571f7e0e8eb35526580e

  • SHA1

    8e83856bb6df3f602ba9a9256f64b057e873512b

  • SHA256

    60907c6c7ea2125fc40e89e845dfd2b7e9d4cc10f04a08f0b00b7784f5d62a9a

  • SHA512

    71c86529aa79d9f6e0ba1325b5f3f196df5e51c4ffdbd68349ed0c4560e6d8d97697938d2a072fd6023867484e3a5f5bae442bff32787ed2f277b2b8ac152255

Score
10/10
sendsafeunregisteredbotnetspam

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

31.44.184.119:50063

31.44.184.119:50064
Attributes
  • service_name

    Enterprise Mailing Service

Targets

    • Target

      119.exe

    • Size

      1.9MB

    • MD5

      c9c0c09e7b2c571f7e0e8eb35526580e

    • SHA1

      8e83856bb6df3f602ba9a9256f64b057e873512b

    • SHA256

      60907c6c7ea2125fc40e89e845dfd2b7e9d4cc10f04a08f0b00b7784f5d62a9a

    • SHA512

      71c86529aa79d9f6e0ba1325b5f3f196df5e51c4ffdbd68349ed0c4560e6d8d97697938d2a072fd6023867484e3a5f5bae442bff32787ed2f277b2b8ac152255

    Score
    10/10
    sendsafeunregisteredbotnetspam

    • SendSafe

      SendSafe is a notorious spam tool which then turned into spam botnet.

      spambotnetsendsafe

    • sendsafe

      SendSafe Payload

      botnet
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks