sendsafe | 38d3f45c15d354a76eaa73d2da717165dee22b8207fa87088685486019ff482d | Triage

Sharing

General

Target

38d3f45c15d354a76eaa73d2da717165dee22b8207fa87088685486019ff482d
Size

1.8MB
Sample

220201-ja1a5saggk
MD5

954e5bfc83812346d1cd11a59f7d205d
SHA1

179dd32769c491758ff2e418c9b20efc94af5725
SHA256

38d3f45c15d354a76eaa73d2da717165dee22b8207fa87088685486019ff482d
SHA512

1d9eb7e3548e9082cccff9823ef7c205d9f161e35b66be22cc9737cfbf013781e56647fb54941945614310ba91f44904fe3341d03cb39779bbc41a1951503feb

Score

10^/10

sendsafe unregistered botnet persistence spam

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

31.44.184.32:50035

31.44.184.32:50036

Attributes

service_name
Enterprise Mailing Service

Targets

- Target
  
  38d3f45c15d354a76eaa73d2da717165dee22b8207fa87088685486019ff482d
- Size
  
  1.8MB
- MD5
  
  954e5bfc83812346d1cd11a59f7d205d
- SHA1
  
  179dd32769c491758ff2e418c9b20efc94af5725
- SHA256
  
  38d3f45c15d354a76eaa73d2da717165dee22b8207fa87088685486019ff482d
- SHA512
  
  1d9eb7e3548e9082cccff9823ef7c205d9f161e35b66be22cc9737cfbf013781e56647fb54941945614310ba91f44904fe3341d03cb39779bbc41a1951503feb
Score

10^/10

sendsafe unregistered botnet spam persistence
- SendSafe
  SendSafe is a notorious spam tool which then turned into spam botnet.
  spam botnet sendsafe
- SendSafe Payload
  botnet
- Sets service image path in registry
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

sendsafeunregisteredbotnetspam

behavioral2

sendsafeunregisteredbotnetpersistencespam