sendsafe | cecbb3cbe018dc3419300d5b350cdfbbb78adc3fb4d97e6738273c45c36bbf0c

Analysis

Target

cecbb3cbe018dc3419300d5b350cdfbbb78adc3fb4d97e6738273c45c36bbf0c.exe
Size

1.8MB
MD5

6ce7ffaf76ea85421e115392ad7c7ba9
SHA1

23c4bf77d07bea66a11e0d2cdf1b19034f718fd4
SHA256

cecbb3cbe018dc3419300d5b350cdfbbb78adc3fb4d97e6738273c45c36bbf0c
SHA512

039c75fd6cda94a5f467be95a7ef093197b3f56eff53590a0edee6d08a008f892132f49746f4623554bdbe85390a47f445eff822e9cd5e90b29753b1e22fe5b4

Score

10^/10

Family

sendsafe

Botnet

UNREGISTERED

31.44.184.119:50073

31.44.184.119:50074

Attributes

SendSafe
SendSafe is a notorious spam tool which then turned into spam botnet.
spam botnet sendsafe

SendSafe Payload 1 IoCs

botnet

Processes:

resource	yara_rule
behavioral2/memory/3736-116-0x0000000000400000-0x00000000005D8000-memory.dmp	sendsafe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

cecbb3cbe018dc3419300d5b350cdfbbb78adc3fb4d97e6738273c45c36bbf0c.exe

pid	process
3736	cecbb3cbe018dc3419300d5b350cdfbbb78adc3fb4d97e6738273c45c36bbf0c.exe
3736	cecbb3cbe018dc3419300d5b350cdfbbb78adc3fb4d97e6738273c45c36bbf0c.exe

C:\Users\Admin\AppData\Local\Temp\cecbb3cbe018dc3419300d5b350cdfbbb78adc3fb4d97e6738273c45c36bbf0c.exe
"C:\Users\Admin\AppData\Local\Temp\cecbb3cbe018dc3419300d5b350cdfbbb78adc3fb4d97e6738273c45c36bbf0c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3736

memory/3736-116-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/3736-115-0x0000000002320000-0x00000000024D2000-memory.dmp

Filesize
1.7MB

Download