ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool WellMail

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: WellMail

NamesWellMail
CategoryMalware
TypeBackdoor
Description(NCSC-UK) WellMail is a lightweight tool designed to run commands or scripts with the results being sent to a hardcoded Command and Control (C2) server.

The NCSC has named this malware ‘WellMail’ due to file paths containing the word ‘mail’ and the use of server port 25 present in the sample analysed. Similar to WellMess, WellMail uses hard-coded client and certificate authority TLS certificates to communicate with C2 servers.

The binary is an ELF utility written in Golang which receives a command or script to be run through the Linux shell. To our knowledge, WellMail has not been previously named in the public domain.
Information<https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development.pdf>
<https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198c>
AlienVault OTX<https://otx.alienvault.com/browse/pulses?q=tag:WellMail>

Last change to this tool card: 17 July 2020

Download this tool card in JSON format

All groups using tool WellMail

ChangedNameCountryObserved

APT groups

 APT 29, Cozy Bear, The DukesRussia2008-2020X

1 group listed (1 APT, 0 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key