TF-MAL-elf.wellmess

Description

ThreatFox malware family `elf.wellmess`.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• WellMess - Threat Group Cards: A Threat Actor Encyclopedia
  web:apt.etda.or.th

  Last change to this tool card: 30 December 2022 Download this tool card in JSON format All groups using tool WellMess

  2026-05-22 05:24 UTC
• 'WellMess" malware - Targeted attacks logbook
  web:apt.securelist.com

  WellMess is a Remote Access Trojan that has been deployed against high-profile targets in MENA and the EU, as well as companies conducting COVID-19 vaccine research.

  2026-05-22 05:24 UTC
• WellMess, Software S0514 | MITRE ATT&CK®
  web:attack.mitre.org

  WellMess is lightweight malware family with variants written in .NET and Golang that has been in use since at least 2018 by APT29. [1] [2] [3]

  2026-05-22 05:24 UTC
• MalwareBazaar | WellMess
  web:bazaar.abuse.ch

  A malware sample can be associated with only one malware family . The page below gives you an overview on malware samples that MalwareBazaar has identified as WellMess.

  2026-05-22 05:24 UTC
• Lightweight ELF header analysis model for IoT malwares ... - IOPscience
  web:iopscience.iop.org

  By understanding these structural differences between malicious and benign ELF files, security analysts can develop more effective detection and mitigation strategies to safeguard systems against evolving malware threats.

  2026-05-22 05:24 UTC
• Remediate vulnerabilities with Microsoft Defender Vulnerability ...
  web:learn.microsoft.com

  Remediate security weaknesses discovered through security recommendations, and create exceptions if needed, in Defender Vulnerability Management.

  2026-05-22 05:24 UTC
• elf.wellmess (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  Details for the elf.wellmess malware family including references, samples and yara signatures.

  2026-05-22 05:24 UTC
• Open Hunting - Threat Library
  web:openhunting.io

  Opensource Threat Hunting & Intelligence (NCSC-UK) WellMess is malware written in either Golang or .NET and has been in use since at least 2018. WellMess was first reported on by JPCERT and LAC researchers in July 2018. It is named after one of the function names in the malware -'wellmess'. WellMess is a lightweight malware designed to execute arbitrary shell commands, upload and download ...

  2026-05-22 05:24 UTC
• MAR-10296782-2.v1 - WELLMESS | CISA
  web:www.cisa.gov

  The files are variants of the malware family known as "WellMess". These implants allow a remote operator to establish encrypted command and control (C2) sessions and to securely pass and execute scripts on an infected system.

  2026-05-22 05:24 UTC
• Mitigating malware and ransomware attacks - The National Cyber Security ...
  web:www.ncsc.gov.uk

  This guidance helps private and public sector organisations deal with the effects of malware (which includes ransomware). It provides actions to help organisations prevent a malware infection, and also steps to take if you're already infected. Following this guidance will reduce: the likelihood of becoming infected the spread of malware throughout your organisation the impact of the infection

  2026-05-22 05:24 UTC

Only Available for Registered Users. Sign in to view.