WellMail

Malware & Tools · WellMail

· MalwareS0515 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

WellMail is a lightweight malware written in Golang used by APT29, similar in design and structure to WellMess.(Citation: CISA WellMail July 2020)(Citation: NCSC APT29 July 2020)

Tactic Coverage

command and control (4)collection (2)discovery (2)stealth (1)

Used By (1 groups)

G0016APT29IRON RITUAL, IRON HEMLOCK

Techniques (9)

T1005Data from Local System

collection

T1016System Network Configuration Discovery

discovery

T1033System Owner/User Discovery

discovery

T1095Non-Application Layer Protocol

command and control

T1105Ingress Tool Transfer

command and control

T1140Deobfuscate/Decode Files or Information

stealth

T1560

References

https://attack.mitre.org/software/S0515 https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198c https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf