sendsafe | 6f20bc878b65135cf35ff7461e520933368b09c27f52ed39e1d697b4e33473ce

Analysis

Target

6f20bc878b65135cf35ff7461e520933368b09c27f52ed39e1d697b4e33473ce.exe
Size

1.8MB
MD5

814702b9eb78736121955b50480c64ff
SHA1

89d81c22be84716aaad3b79642ffb4992c71d1a4
SHA256

6f20bc878b65135cf35ff7461e520933368b09c27f52ed39e1d697b4e33473ce
SHA512

fe141140cc11264bd374796dc3e24d28f8170eb27f2391d5ceb19d0366ade92a5eec176c1eb5e16515307917b724763a25d410c753d0ac24e2bba04851b23217

Score

10^/10

Family

sendsafe

Botnet

UNREGISTERED

31.44.184.32:50023

31.44.184.32:50024

Attributes

SendSafe
SendSafe is a notorious spam tool which then turned into spam botnet.
spam botnet sendsafe

SendSafe Payload 1 IoCs

botnet

Processes:

resource	yara_rule
behavioral2/memory/4736-135-0x0000000000400000-0x00000000005CB000-memory.dmp	sendsafe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

6f20bc878b65135cf35ff7461e520933368b09c27f52ed39e1d697b4e33473ce.exe

pid	process
4736	6f20bc878b65135cf35ff7461e520933368b09c27f52ed39e1d697b4e33473ce.exe
4736	6f20bc878b65135cf35ff7461e520933368b09c27f52ed39e1d697b4e33473ce.exe

C:\Users\Admin\AppData\Local\Temp\6f20bc878b65135cf35ff7461e520933368b09c27f52ed39e1d697b4e33473ce.exe
"C:\Users\Admin\AppData\Local\Temp\6f20bc878b65135cf35ff7461e520933368b09c27f52ed39e1d697b4e33473ce.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4736

memory/4736-134-0x00000000025A0000-0x0000000002752000-memory.dmp

Filesize
1.7MB

Download
memory/4736-135-0x0000000000400000-0x00000000005CB000-memory.dmp

Filesize
1.8MB

Download