Kategorie: Email-Worm
E-Mail-Würmer verbreiten sich per E-Mail. Der Wurm sendet eine Kopie von sich selbst als Anhang an eine E-Mail-Nachricht oder einen Link zu seiner Datei auf einer Netzwerkressource (z. B. eine URL zu einer infizierten Datei auf einer kompromittierten Website oder einer Hacker-eigenen Website).Im ersten Fall wird der Wurmcode aktiviert, wenn der infizierte Anhang geöffnet (gestartet) wird. Im zweiten Fall wird der Code aktiviert, wenn der Link zur infizierten Datei geöffnet wird. In beiden Fällen ist das Ergebnis dasselbe: Der Wurmcode ist aktiviert.
Email-Würmer verwenden eine Reihe von Methoden, um infizierte E-Mails zu versenden. Die häufigsten sind:
Verwenden einer direkten Verbindung zu einem SMTP-Server mithilfe des E-Mail-Verzeichnisses, das in den Code des Wurms integriert ist
Verwenden von MS Outlook-Diensten
Verwenden von Windows MAPI-Funktionen.
Email-Würmer verwenden eine Reihe verschiedener Quellen, um E-Mail-Adressen zu finden, an die infizierte E-Mails gesendet werden:
das Adressbuch in MS Outlook
eine WAB-Adressdatenbank
.txt-Dateien, die auf der Festplatte gespeichert sind: Der Wurm kann feststellen, welche Zeichenfolgen in Textdateien E-Mail-Adressen sind
E-Mails im Posteingang (einige E-Mail-Würmer "antworten" sogar auf E-Mails im Posteingang)
Viele E-Mail-Würmer verwenden mehr als eine der oben aufgeführten Quellen. Es gibt auch andere Quellen für E-Mail-Adressen, z. B. Adressbücher für webbasierte E-Mail-Dienste.
Mehr Informationen
Plattform: Win32
Win32 ist eine API auf Windows NT-basierten Betriebssystemen (Windows XP, Windows 7 usw.), die die Ausführung von 32-Bit-Anwendungen unterstützt. Eine der am weitesten verbreiteten Programmierplattformen der Welt.Familie: Email-Worm.Win32.Bagle
No family descriptionExamples
5B4A3E238DA7624DAFBA90A2758A578E29DE026CF2B407CDEF695D6C4E809EC5
FEF560388595DC6C5EC4CFCFBE645A73
B1046354AA09BE58FAA1E3BD185E2DBC
1DF6A99A6C1D23831F9E3787FE7A1E5E
Tactics and Techniques: Mitre*
TA0003
Persistence
The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.
T1547.001
Registry Run Keys / Startup Folder
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
TA0004
Privilege Escalation
The adversary is trying to gain higher-level permissions. Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include: SYSTEM/root level, local administrator, user account with admin-like access, user accounts with access to specific system or perform specific function. These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.
T1547.001
Registry Run Keys / Startup Folder
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
TA0005
Defense Evasion
The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics' techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1036.005
Match Legitimate Name or Location
Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.
T1036.007
Double File Extension
Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name may include a secondary file type extension that may cause only the first extension to be displayed (ex:
File.txt.exe may render in some views as just File.txt). However, the second extension is the true file type that determines how the file is opened and executed. The real file extension may be hidden by the operating system in the file browser (ex: explorer.exe), as well as in any software configured using or similar to the system’s policies. T1036.008
Masquerade File Type
Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file, is
0xFF 0xD8 and the file extension is either `.JPE`, `.JPEG` or `.JPG`. T1112
Modify Registry
Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.