sendsafe | 676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4

Analysis

Target

676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4.exe
Size

1.8MB
MD5

3b06a29a97cc177e0ead020232757c49
SHA1

f866cb89ead83d13ad49573ef4f2671c4caa967d
SHA256

676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4
SHA512

e4077465f6aeb45c23ba8bc17c076bb03459b1c9266aa9c813b63c6a5b553e349c7fbb38fadec54edd471cbec1f7e7f823ab0dafe759994bf120e0f454f061dd

Score

10^/10

Family

sendsafe

Botnet

UNREGISTERED

31.44.184.32:50069

31.44.184.32:50070

Attributes

SendSafe
SendSafe is a notorious spam tool which then turned into spam botnet.
spam botnet sendsafe

SendSafe Payload 2 IoCs

botnet

Processes:

resource	yara_rule
behavioral2/memory/2632-131-0x0000000000400000-0x00000000005D5000-memory.dmp	sendsafe
behavioral2/memory/2632-133-0x0000000000400000-0x00000000005D5000-memory.dmp	sendsafe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4.exe

pid	process
2632	676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4.exe
2632	676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4.exe

C:\Users\Admin\AppData\Local\Temp\676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4.exe
"C:\Users\Admin\AppData\Local\Temp\676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2632

memory/2632-130-0x0000000002500000-0x00000000026B2000-memory.dmp

Filesize
1.7MB

Download
memory/2632-131-0x0000000000400000-0x00000000005D5000-memory.dmp

Filesize
1.8MB

Download
memory/2632-132-0x0000000002500000-0x00000000026B2000-memory.dmp

Filesize
1.7MB

Download
memory/2632-133-0x0000000000400000-0x00000000005D5000-memory.dmp

Filesize
1.8MB

Download