ATT&CK SoftwareWellMail

WellMail

S0515

Malware.View on attack.mitre.org

About this malware

WellMail is a lightweight malware written in Golang used by APT29, similar in design and structure to WellMess.

Techniques used9

Stealth1

T1140Deobfuscate/Decode Files or Information

Discovery2

T1016System Network Configuration Discovery T1033System Owner/User Discovery

Collection2

T1005Data from Local System T1560Archive Collected Data

Command and Control4

T1095Non-Application Layer Protocol T1105Ingress Tool Transfer T1571Non-Standard Port T1573.002Asymmetric Cryptography

Procedure examples9

Technique	Procedure example
T1005 Data from Local System	WellMail can exfiltrate files from the victim machine. CISA WellMail July 2020
T1016 System Network Configuration Discovery	WellMail can identify the IP address of the victim system. CISA WellMail July 2020
T1033 System Owner/User Discovery	WellMail can identify the current username on the victim system. CISA WellMail July 2020
T1095 Non-Application Layer Protocol	WellMail can use TCP for C2 communications. CISA WellMail July 2020
T1105 Ingress Tool Transfer	WellMail can receive data and executable scripts from C2. CISA WellMail July 2020
T1140 Deobfuscate/Decode Files or Information	WellMail can decompress scripts received from C2. CISA WellMail July 2020
T1560 Archive Collected Data	WellMail can archive files on the compromised host. CISA WellMail July 2020
T1571 Non-Standard Port	WellMail has been observed using TCP port 25, without using SMTP, to leverage an open port for secure command and control communications. CISA WellMail July 2020 NCSC APT29 July 2020
T1573.002 Asymmetric Cryptography	WellMail can use hard coded client and certificate authority certificates to communicate with C2 over mutual TLS. CISA WellMail July 2020 NCSC APT29 July 2020

Groups that use it1

Campaigns0

None recorded.

References2

CISA WellMail July 2020 Open source
CISA. (2020, July 16). MAR-10296782-3.v1 – WELLMAIL. Retrieved September 29, 2020.
NCSC APT29 July 2020 Open source
National Cyber Security Centre. (2020, July 16). Advisory: APT29 targets COVID-19 vaccine development. Retrieved September 29, 2020.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.