sendsafe | ece78097b518756e973a2183e2c5075f1c1133b6abaf1d34b5dec39a6285f358

Analysis

Target

ece78097b518756e973a2183e2c5075f1c1133b6abaf1d34b5dec39a6285f358.exe
Size

1.7MB
MD5

8ad1d303eb8cd37ccd68916bb007cc8a
SHA1

db4f8e16d7c1fa6c9a2aa92bb8be72e7bd7db000
SHA256

ece78097b518756e973a2183e2c5075f1c1133b6abaf1d34b5dec39a6285f358
SHA512

dd6affd15b225886e9abf0d1d03978c0b8d856a387992cdce293a7b3d521574fd792b6321740e0c3b499fcacb6d0d67d33b1b46044b0a3e3b036d86de8f98e60

Score

10^/10

Family

sendsafe

Botnet

UNREGISTERED

195.2.240.119:50099

195.2.240.119:50100

Attributes

SendSafe
SendSafe is a notorious spam tool which then turned into spam botnet.
spam botnet sendsafe

SendSafe Payload 1 IoCs

botnet

Processes:

resource	yara_rule
behavioral2/memory/1040-135-0x0000000000400000-0x00000000005C9000-memory.dmp	sendsafe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ece78097b518756e973a2183e2c5075f1c1133b6abaf1d34b5dec39a6285f358.exe

pid	process
1040	ece78097b518756e973a2183e2c5075f1c1133b6abaf1d34b5dec39a6285f358.exe
1040	ece78097b518756e973a2183e2c5075f1c1133b6abaf1d34b5dec39a6285f358.exe

C:\Users\Admin\AppData\Local\Temp\ece78097b518756e973a2183e2c5075f1c1133b6abaf1d34b5dec39a6285f358.exe
"C:\Users\Admin\AppData\Local\Temp\ece78097b518756e973a2183e2c5075f1c1133b6abaf1d34b5dec39a6285f358.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1040

memory/1040-134-0x0000000002470000-0x0000000002622000-memory.dmp

Filesize
1.7MB

Download
memory/1040-135-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download