Classe: Email-Worm
Email-Worms espalhado via email. O worm envia uma cópia de si mesmo como um anexo a uma mensagem de e-mail ou um link para seu arquivo em um recurso de rede (por exemplo, um URL para um arquivo infectado em um site comprometido ou um site de propriedade de hackers). No primeiro caso, o código do worm é ativado quando o anexo infectado é aberto (ativado). No segundo caso, o código é ativado quando o link para o arquivo infectado é aberto. Em ambos os casos, o resultado é o mesmo: o código do worm é ativado. Os worms de email usam uma variedade de métodos para enviar emails infectados. Os mais comuns são: usar uma conexão direta com um servidor SMTP usando o diretório de e-mail embutido no código do worm usando os serviços do MS Outlook usando as funções do Windows MAPI. Os worms de e-mail usam várias fontes diferentes para encontrar endereços de e-mail para os quais os e-mails infectados serão enviados: o catálogo de endereços do MS Outlook, um banco de dados de endereços WAB .txt armazenado no disco rígido: o worm pode identificar quais strings são e-mails de endereços de e-mail na caixa de entrada (alguns worms de e-mail até mesmo “respondem” a e-mails encontrados na caixa de entrada) Muitos worms de e-mail usam mais de uma das fontes listadas acima. Há também outras fontes de endereços de e-mail, como catálogos de endereços associados a serviços de e-mail baseados na web.Plataforma: Win32
O Win32 é uma API em sistemas operacionais baseados no Windows NT (Windows XP, Windows 7, etc.) que oferece suporte à execução de aplicativos de 32 bits. Uma das plataformas de programação mais difundidas do mundo.Família: Email-Worm.Win32.LovGate
No family descriptionExamples
B19F189C6ED88BCE38E7C3C90D961115BB75D1A7A170C4BD433BD8AEAA71E7F1
A74893C9EA2AC4534218DE7D9EF3655E
52BABDDDD434F710D33B799DF5933DD4
F3BA80A29C0638AEA27E20F09BCF72EE
Tactics and Techniques: Mitre*
TA0006
Credential Access
The adversary is trying to steal account names and passwords.
Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.
Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.
T1555.003
Credentials from Password Stores: Credentials from Web Browsers
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation: Talos Olympic Destroyer 2018) Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.
For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file,
Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc.(Citation: Proofpoint Vega Credential Stealer May 2018)(Citation: FireEye HawkEye Malware July 2017) Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager.
Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.(Citation: GitHub Mimikittenz July 2016)
After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).
For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file,
AppData\Local\Google\Chrome\User Data\Default\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key.(Citation: Microsoft CryptUnprotectData April 2018)Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc.(Citation: Proofpoint Vega Credential Stealer May 2018)(Citation: FireEye HawkEye Malware July 2017) Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager.
Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.(Citation: GitHub Mimikittenz July 2016)
After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.