| ID |
B0020 |
| Objective(s) |
Execution, Lateral Movement |
| Related ATT&CK Techniques |
Phishing (T1566) |
| Version |
2.0 |
| Created |
1 August 2019 |
| Last Modified |
12 June 2023 |
# Send Email
Sends an email message from the system on which the malware is executing to one or more recipients, mostly commonly for the purpose of spamming or for distributing a malicious attachment or URL (malspamming).
This behavior is related to the **Phishing ([T1566](https://attack.mitre.org/techniques/T1566/))** ATT&CK technique defined under ATT&CK's Initial Access tactic.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut probes the infected system's SMTP port 25 by sending a test SMTP transaction to mail.ru and hotmail.com. If port 25 is open, the bot requests the spam template and email list, which it uses to send spam. [[1]](#1)|
|[**Bagle**](../xample-malware/bagle.md)|2004|--|Bagle uses its own SMTP engine to mass-mail itself as an attachment from an infected computer. [[2]](#2)|
|[**Emotet**](../xample-malware/emotet.md)|2018|--|Spam email with the Emotet loader is sent automatically. [[3]](#3)|
## References