mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Desiree Beck
24 lines
1.6 KiB
Markdown
24 lines
1.6 KiB
Markdown
|||
|
|
|---------|------------------------|
|
|
|**ID**|**M0020**|
|
|
|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution), [Lateral Movement](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement)|
|
|
|**Related ATT&CK Technique(s)**|[Spearphishing Attachment](https://attack.mitre.org/techniques/T1193), [Spearphishing Link](https://attack.mitre.org/techniques/T1192)|
|
|
|
|
Send Email
|
|
==========
|
|
Sends an email message from the system on which the malware is executing to one or more recipients, mostly commonly for the purpose of spamming or for distributing a malicious attachment or URL (malspamming).
|
|
|
|
**See related ATT&CK Techniques:** [**Spearphishing Attachment**](https://attack.mitre.org/techniques/T1193), [**Spearphishing Link**](https://attack.mitre.org/techniques/T1192). These techniques are defined in PRE-ATT&CK, and being related to initial access are not included in MBC.
|
|
|
|
Malware Examples
|
|
----------------
|
|
|Name|Date|Description|
|
|
|--------------|--------------------------|-----------------------------|
|
|
|Gamut|2014|Gamut probes the infected system's SMTP port 25 by sending a test SMTP transaction to mail.ru and hotmail.com. If port 25 is open, the bot requests the spam template and email list, which it uses to send spam. [[1]](#1)|
|
|
|Bagle|2004|Bagle uses its own SMTP engine to mass-mail itself as an attachment from an infected computer. [[2]](#2)|
|
|
|
|
References
|
|
----------
|
|
<a name="1">[1]</a> https://www.trustwave.com/Resources/SpiderLabs-Blog/Gamut-Spambot-Analysis/
|
|
|
|
<a name="2">[2]</a> https://en.wikipedia.org/wiki/Bagle_(computer_worm) |