クラス: Email-Worm
Email-Wormsは電子メールで広がります。ワームは、電子メールメッセージへの添付ファイル、またはネットワークリソース上のファイルへのリンク（例えば、侵害されたWebサイトやハッカー所有のWebサイト上の感染ファイルへのURL）として自身のコピーを送信します。最初のケースでは、感染した添付ファイルが開かれた（起動された）ときにワームコードがアクティブになります。 2番目のケースでは、感染ファイルへのリンクが開かれたときにコードが有効になります。どちらの場合も、結果は同じです：ワームコードが有効になっています。 Email-Wormは、感染した電子メールを送信するためにさまざまな方法を使用します。最も一般的なのは、Windows MAPI機能を使用するMS Outlookサービスを使用してワームのコードに組み込まれた電子メールディレクトリを使用してSMTPサーバーに直接接続することです。 Email-Wormsは、感染した電子メールが送信される電子メールアドレスを見つけるためにいくつかの異なるソースを使用しています：MS Outlookのアドレス帳ハードドライブに格納されたWABアドレスデータベース.txtファイル：ワームはテキストファイルのどの文字列メールボックスは、受信ボックス内の電子メールアドレスを扱います（一部の電子メールワームは、受信ボックスにある電子メールにも「返信」します）。多くのEメールワームは、上記のソースのうちの複数を使用します。 Webベースの電子メールサービスに関連付けられたアドレス帳など、電子メールアドレスの他のソースもあります。プラットフォーム: Win32
Win32は、32ビットアプリケーションの実行をサポートするWindows NTベースのオペレーティングシステム（Windows XP、Windows 7など）上のAPIです。世界で最も広く普及しているプログラミングプラットフォームの1つです。ファミリー: Email-Worm.Win32.LovGate
No family descriptionExamples
C01D6D30BEC0129D485DC1953EB0D6AF4CC738181D4E18E16E70BB60DD611BA5
4E79C1DA5BBB4F093C1464775675D19B
B00CEA9A33D3C3111DF6630A9E81EFD8
943019A23412D3309C14FA2AC322220F
Tactics and Techniques: Mitre*
TA0009
Collection
The adversary is trying to gather data of interest to their goal.
Collection consists of techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary's objectives. Frequently, the next goal after collecting data is to steal (exfiltrate) the data. Common target sources include various drive types, browsers, audio, video, and email. Common collection methods include capturing screenshots and keyboard input.
Collection consists of techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary's objectives. Frequently, the next goal after collecting data is to steal (exfiltrate) the data. Common target sources include various drive types, browsers, audio, video, and email. Common collection methods include capturing screenshots and keyboard input.
T1113
Screen Capture
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as
CopyFromScreen, xwd, or screencapture.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)TA0011
Command and Control
The adversary is trying to communicate with compromised systems to control them.
Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.
Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.
T1071.003
Application Layer Protocol: Mail Protocols
Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the email messages themselves. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the email messages themselves. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.