MBCProject-mbc-markdown/execution/send-email.md

ID	B0020
Objective(s)	Execution, Lateral Movement
Related ATT&CK Techniques	Phishing (T1566)
Version	2.0
Created	1 August 2019
Last Modified	31 October 2022

Send Email

Sends an email message from the system on which the malware is executing to one or more recipients, mostly commonly for the purpose of spamming or for distributing a malicious attachment or URL (malspamming).

This behavior is related to the Phishing (T1566) ATT&CK technique defined under ATT&CK's Initial Access tactic.

Use in Malware

Name	Date	Description
Gamut	2014	Gamut probes the infected system's SMTP port 25 by sending a test SMTP transaction to mail.ru and hotmail.com. If port 25 is open, the bot requests the spam template and email list, which it uses to send spam. [1]
Bagle	2004	Bagle uses its own SMTP engine to mass-mail itself as an attachment from an infected computer. [2]
TrickBot	2016	Trojan spyware program that has mainly been used for targeting banking sites.
Emotet	2018	spam email with the Emotet loader is sent automatically [3]

References

[1] https://www.trustwave.com/Resources/SpiderLabs-Blog/Gamut-Spambot-Analysis/

[2] https://en.wikipedia.org/wiki/Bagle_(computer_worm)

[3] https://securelist.com/the-banking-trojan-emotet-detailed-analysis/69560/