sendsafe | 30505e6aa6a549462dbce448912969cf1681023710797d2bb0e76246e436deb8

Analysis

Target

30505e6aa6a549462dbce448912969cf1681023710797d2bb0e76246e436deb8.exe
Size

2.1MB
MD5

686baf9e0dd47eac47e6f994a83412a7
SHA1

1b3c61d9a6194f956654713532fb39a8abdd5495
SHA256

30505e6aa6a549462dbce448912969cf1681023710797d2bb0e76246e436deb8
SHA512

437eae8f0c0006cf87df55f7915571ec463e9ea7a9e00c5849b8ad0b041b6d7789fb1c3b9cdfab4db693517015f3e76cc296414870c5dab22612108554adfb03

Score

10^/10

Family

sendsafe

Botnet

UNREGISTERED

31.44.184.32:50003

31.44.184.32:50004

Attributes

SendSafe
SendSafe is a notorious spam tool which then turned into spam botnet.
spam botnet sendsafe

SendSafe Payload 2 IoCs

botnet

Processes:

resource	yara_rule
behavioral2/memory/3268-131-0x0000000000400000-0x0000000000619000-memory.dmp	sendsafe
behavioral2/memory/3268-132-0x0000000000400000-0x0000000000619000-memory.dmp	sendsafe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

30505e6aa6a549462dbce448912969cf1681023710797d2bb0e76246e436deb8.exe

pid	process
3268	30505e6aa6a549462dbce448912969cf1681023710797d2bb0e76246e436deb8.exe
3268	30505e6aa6a549462dbce448912969cf1681023710797d2bb0e76246e436deb8.exe

C:\Users\Admin\AppData\Local\Temp\30505e6aa6a549462dbce448912969cf1681023710797d2bb0e76246e436deb8.exe
"C:\Users\Admin\AppData\Local\Temp\30505e6aa6a549462dbce448912969cf1681023710797d2bb0e76246e436deb8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3268

memory/3268-130-0x0000000002730000-0x00000000028E2000-memory.dmp

Filesize
1.7MB

Download
memory/3268-131-0x0000000000400000-0x0000000000619000-memory.dmp

Filesize
2.1MB

Download
memory/3268-132-0x0000000000400000-0x0000000000619000-memory.dmp

Filesize
2.1MB

Download