sendsafe | a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392 | Triage

Sharing

General

Target

a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392
Size

1.9MB
Sample

220201-e9hsxshdc2
MD5

c0befca5b32a78f917b5d54aa7ef823d
SHA1

e867751ad701d02e7a265c1343cdfe632281c992
SHA256

a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392
SHA512

06df8ab58f0aa76410c85c5796d2638c9e74694ba0497d454ca9427b1a479b0c803cc9875aa2e13950d7718ee46a0b4bc40d7238ec20e5f0ff60da648c3bcee2

Score

10^/10

sendsafe unregistered botnet persistence spam

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

31.44.184.32:50045

31.44.184.32:50046

Attributes

service_name
Enterprise Mailing Service

Targets

- Target
  
  a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392
- Size
  
  1.9MB
- MD5
  
  c0befca5b32a78f917b5d54aa7ef823d
- SHA1
  
  e867751ad701d02e7a265c1343cdfe632281c992
- SHA256
  
  a9a117ae98fd5a5f90a2058461be2dc525bde25a920d9acaeae2490633587392
- SHA512
  
  06df8ab58f0aa76410c85c5796d2638c9e74694ba0497d454ca9427b1a479b0c803cc9875aa2e13950d7718ee46a0b4bc40d7238ec20e5f0ff60da648c3bcee2
Score

10^/10

sendsafe unregistered botnet spam persistence
- SendSafe
  SendSafe is a notorious spam tool which then turned into spam botnet.
  spam botnet sendsafe
- SendSafe Payload
  botnet
- Sets service image path in registry
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

sendsafeunregisteredbotnetspam

behavioral2

sendsafeunregisteredbotnetpersistencespam