Basic Phishing Analysis
In this posts I am going to practise some basic phishing analysis. I will be showing methods and tools used to analyse email headers, attachements, urls…
Setup
For this task I have setup a virtual machine that would server as my lab. I’ve cloned this repo to get some samples. Please show the owner some support.
Manual Analysis
Headers
I’ve chosen the sample-10.eml. Let’s take a look at the important header fields:
Timestamp : Fri 8 sep 2023 05:47:04
Spf : none dkin : none dmarc : permerror
==> failing these security fields is an indicator of a phishing attempt.
Smtp.mailfrom : thcultarfdes.co.uk Sender-ip : 89.144.44.2 sender-address : no-reply@access-accsecurity.com Reply-to-address : sotrecognizd@gmail.com
==> the IP resolves to germany, while the (thcultarfdes.co.uk) does not have an AAAA records which adds to the suspicion.
==> the difference between the sender-address and the reply-to is an indicator of suspicious behaviour.
Email-subject : Microsoft account unusual signin activity
==> classic method to get the recipient to open the email and click the link.
Payload
I went on and copied the whole payload and put it in an html file, i opened the file in my browser you do not have to do this but this is my workflow anyway we can see the page has multiple links that leads to a mailto address to the same reply-to address.
There is also an image and after inspection it turned out to be a tracking pixel.
Conclusions
==> this is not a usual phishing email since the links in the payload do not lead to a credential harvesting sites or downloades a malicious payload instead it gets the user to reply back zhich leads me to think that this is a reply-bait scheme where the goal is to confirm that the account is live so then the address could be sold to other actors.
I hope this was a learning experience for the reader.
Links
These are some links for tools that helps to analyze emails:
url,file analysis Virus Total.
header analysis MxtoolBox.
ip-address resolution ipinfo.
header analysis MailHeader.