RogueApps
When Good Apps Go Rogue | Powered by Huntress
Tracking 7 rogue applications
No matching applications found. Try a different search term.
eM Client
A robust email client often leveraged by attackers due to its extensive capabilities. eM Client allows attackers to sync multiple inboxes into the same client, download all emails from an inbox, mass mail spam, export calendars and contacts, and create inbox rules to stage financial transaction fraud.
App ID: e9a7fea1-1cc0-4cd9-a31b-9137ca5deedd
Owner Organization ID: 146ecd75-4414-4ecf-ba6d-ea611895da8c
Publisher: eM Client s.r.o.
Contributors: Huntress Research Team, lukesteward
MITRE TTP: N/A
Tags: BEC, email, spam
Permissions:
-
Microsoft Graph:EWS.AccessAsUser.All(Delegated) -
Microsoft Graph:offline_access(Delegated) -
Microsoft Graph:email(Delegated) -
Microsoft Graph:openid(Delegated) -
Microsoft Graph:IMAP.AccessAsUser.All(Delegated)
References:
PerfectData Software
An application that can export mailboxes for backup purposes. Used maliciously to exfiltrate data and stage financial fraud transactions.
App ID: ff8d92dc-3d82-41d6-bcbd-b9174d163620
Owner Organization ID: f094ec52-8e94-47b5-851b-2fcd0e31db52
Publisher: PERFECTDATA SOFTWARE
Contributors: Huntress Research Team, randomaccess3, lukesteward
MITRE TTP: N/A
Tags: exfiltration, BEC, backup
Permissions:
-
Microsoft Graph:offline_access(Delegated) -
Microsoft Graph:profile(Delegated) -
Microsoft Graph:User.Read(Delegated) -
Microsoft Graph:openid(Delegated) -
Microsoft Exchange:EWS.AccessAsUser.All(Delegated)
References:
- https://cybercorner.tech/malicious-azure-application-perfectdata-software-and-office365-business-email-compromise/
- https://darktrace.com/blog/how-abuse-of-perfectdata-software-may-create-a-perfect-storm-an-emerging-trend-in-account-takeovers
- https://www.secureworks.com/blog/qr-phishing-leads-to-microsoft-365-account-compromise
- https://github.com/randomaccess3/detections/blob/main/M365_Oauth_Apps/MaliciousOauthAppDetections.json
Newsletter Software Supermailer
Software used for email mass mailing, often abused to send phishing emails. Requires administrator consent to use with Microsoft365, which then allows the application to send from any mailbox within the tenant.
App ID: a245e8c0-b53c-4b67-9b45-751d1dff8e6b
Owner Organization ID: unknown
Publisher: unknown
Contributors: Syne0
MITRE TTP: T1583.006, T1566, T1588.002, T1657
Tags: BEC, spam, phishing
Permissions:
-
Microsoft Graph:Contacts.Read(Delegated) -
Microsoft Graph:Mail.Read(Delegated) -
Microsoft Graph:Mail.Send(Delegated) -
Microsoft Graph:offline_access(Delegated) -
Microsoft Graph:Mail.Read(Application) -
Microsoft Graph:Mail.Send(Application) -
Microsoft Graph:Contacts.Read(Application)
References:
- https://int.supermailer.de/
- https://www.darkreading.com/endpoint-security/supermailer-abuse-email-security-super-sized-credential-theft
- https://trustifi.com/blog/what-is-a-supermailer-email-phishing-attack/
- https://darktrace.com/blog/business-email-compromise-to-mass-phishing-campaign-attack-analysis
- https://www.linkedin.com/posts/damien-miller-mcandrews_businessemailcompromise-activity-7231350791607881732-UAWJ
rclone
Rclone is a command-line program to manage files on cloud storage. It allows the user to download all files the user account can access within OneDrive and SharePoint.
App ID: b15665d9-eda6-4092-8539-0eec376afd59
Owner Organization ID: unknown
Publisher: unknown
Contributors: Syne0, randomaccess3
MITRE TTP: T1567, T1083, T1048
Tags: exfiltration, BEC
Permissions:
-
Microsoft Graph:Files.Read(Delegated) -
Microsoft Graph:Files.ReadWrite(Delegated) -
Microsoft Graph:Files.Read.All(Delegated) -
Microsoft Graph:Files.ReadWrite.All(Delegated) -
Microsoft Graph:Sites.Read.All(Delegated) -
Microsoft Graph:Files.ReadWrite(Delegated) -
Microsoft Graph:offline_access(Delegated)
References:
CloudSponge
CloudSponge allows you to export all contacts from an inbox. These contacts can be used as targets for phishing emails, allowing an email compromise campaign to spread more.
App ID: a43e5392-f48b-46a4-a0f1-098b5eeb4757
Owner Organization ID: unknown
Publisher: unknown
Contributors: Syne0, randomaccess3
MITRE TTP: T1567
Tags: exfiltration, BEC, AddressBook
Permissions:
-
Microsoft Graph:openid(Delegated) -
Microsoft Graph:profile(Delegated) -
Microsoft Graph:Contacts.Read(Delegated) -
Microsoft Graph:People.Read(Delegated)
References:
SigParser
SigParser is used to exfiltrate contacts and recipients from an account's address list, calendars, and email, allowing malicious email such as spam or phishing to easily target relevant recipients.
App ID: caffae8c-0882-4c81-9a27-d1803af53a40
Owner Organization ID: 28300cff-466f-4374-a59a-f3e5a6fc2c56
Publisher: unknown
Contributors: Syne0, randomaccess3
MITRE TTP: T1530, T1567, T1087.003
Tags: collecion, exfiltration, phishing, BEC
Permissions:
-
Microsoft Graph:Calendars.Read.Shared(Delegated) -
Microsoft Graph:Contacts.ReadWrite.Shared(Delegated) -
Microsoft Graph:Mail.Read.Shared(Delegated) -
Microsoft Graph:User.ReadBasic.All(Delegated) -
Microsoft Graph:offline_access(Delegated) -
Microsoft Graph:User.Read(Delegated)
References:
- https://cybercorner.tech/common-oauth-apps-used-in-business-email-compromise/#SigParser
- https://support.sigparser.com/en/articles/8844405-i-think-someone-hacked-my-mailbox-can-you-delete-my-account
- https://github.com/randomaccess3/detections/blob/main/M365_Oauth_Apps/MaliciousOauthAppDetections.json
Mail_Backup
Exports mailboxes for backup purposes, used by threat actors to exfiltrate email. This is the new name for PERFECTDATA SOFTWARE, representing a rebrand of the same malicious application.
App ID: 2ef68ccc-8a4d-42ff-ae88-2d7bb89ad139
Owner Organization ID: f094ec52-8e94-47b5-851b-2fcd0e31db52
Publisher: PERFECTDATA SOFTWARE
Contributors: Syne0, randomaccess3, lukesteward
MITRE TTP: N/A
Tags: exfiltration, BEC, backup
Permissions:
-
Microsoft Graph:offline_access(Delegated) -
Microsoft Graph:profile(Delegated) -
Microsoft Graph:User.Read(Delegated) -
Microsoft Graph:openid(Delegated) -
Microsoft Graph:Mail.Read(Delegated) -
Microsoft Graph:MailboxFolder.Read(Delegated) -
Microsoft Graph:Contacts.Read(Delegated) -
Microsoft Graph:Calendars.Read(Delegated) -
Microsoft Graph:MailboxSettings.Read(Delegated) -
Microsoft Graph:Mail.ReadWrite(Delegated) -
Microsoft Graph:MailboxFolder.ReadWrite(Delegated)
References:
- https://cybercorner.tech/malicious-azure-application-perfectdata-software-and-office365-business-email-compromise/
- https://darktrace.com/blog/how-abuse-of-perfectdata-software-may-create-a-perfect-storm-an-emerging-trend-in-account-takeovers
- https://www.secureworks.com/blog/qr-phishing-leads-to-microsoft-365-account-compromise
- https://github.com/randomaccess3/detections/blob/main/M365_Oauth_Apps/MaliciousOauthAppDetections.json