AS14613

www.us-cert.gov

wellmess.net

x643.microsoft

chat.download

random.next

whois.ripe.net

estnoc.ee

www.tocici.com

botlib.work

evokedigital.in

botlib.new

malware.us-cert.gov

noc@lubnanet.com

webmaster@estnoc.ee

abuse@sg.leaseweb.com

radhe@evokedigital.in

extract.bin

powershell.dll

variable.max

publickey.key

this.max

cmd.exe

botlib.key

f18ced8772e9d1a640b8b4a731dfb6e0

a32e1202257a2945bf0f878c58490af8

2f9f4f2a9d438cdc944f79bdf44a18f8

3a9cdd8a5cbc3ab10ad64c4bb641b41f

c5d5cb99291fa4b2a68b5ea3ff9d9f9a

8777a9796565effa01b03cf1cea9d24d

f34d5f2d4577ed6d9ceec516c1f5a744

25e1daba00e54a31c1d9bb459988f669

f662c2f95c916d5bd4f0c939236a81e9

668481e5e1971f610581ea0b01b617b5

1d4922f19bd3e79cfdf93cd91be7af27

e3b0c44298fc1c149afbf4c8996fb924

23033dcad2d60574ea8a65862431f46b950e54c3

01a71390892fad77987aa09a630b04ff72e37d5d

709878e13633e44b45ad1ab569ad34e3dc1efd3b

14e9b5e214572cb13ff87727d680633f5ee238259043357c94302654c546cad2

7c39841ba409bce4c2c35437ecf043f22910984325c70b9530edf15d826147ee

e329607379a01483fc914a47c0062d5a3a8d8d65f777fbad2c5a841a90a0af09

47cdb87c27c4e30ea3e2de620bed380d5aed591bc50c49b55fd43e106f294854

58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2

0c5ad1e8fe43583e279201cdb1046aea742bae59685e6da24e963a41df987494

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

141.98.212.55

209.58.186.196

85.93.2.0

141.98.212.0

209.58.184.0

200.200.200.221

192.48.88.0

200.200.200.150

103.73.191.255

http://www.us-cert.gov/tlp.

http://85.93.2.116

http://www.tocici.com

https://www.cisa.gov/forms/feedback

rule CISA_10296782_01 : trojan WELLMESS {
	meta:
		Author = "CISA Code & Media Analysis"
		Date = "2020-07-06"
		Last_Modified = "20200706_1017"
		Actor = "n/a"
		Category = "Trojan"
		Family = "WellMess"
		Description = "Detects WellMess implant and SangFor Exploit"
		MD5_1 = "4d38ac3319b167f6c8acb16b70297111"
		SHA256_1 = "7c39841ba409bce4c2c35437ecf043f22910984325c70b9530edf15d826147ee"
		MD5_2 = "a32e1202257a2945bf0f878c58490af8"
		SHA256_2 = "a4b790ddffb3d2e6691dcacae08fb0bfa1ae56b6c73d70688b097ffa831af064"
		MD5_3 = "861879f402fe3080ab058c0c88536be4"
		SHA256_3 = "14e9b5e214572cb13ff87727d680633f5ee238259043357c94302654c546cad2"
		MD5_4 = "2f9f4f2a9d438cdc944f79bdf44a18f8"
		SHA256_4 = "e329607379a01483fc914a47c0062d5a3a8d8d65f777fbad2c5a841a90a0af09"
		MD5_5 = "ae7a46529a0f74fb83beeb1ab2c68c5c"
		SHA256_5 = "fd3969d32398bbe3709e9da5f8326935dde664bbc36753bd41a0b111712c0950"
		MD5_6 = "f18ced8772e9d1a640b8b4a731dfb6e0"
		SHA256_6 = "953b5fc9977e2d50f3f72c6ce85e89428937117830c0ed67d468e2d93aa7ec9a"
		MD5_7 = "3a9cdd8a5cbc3ab10ad64c4bb641b41f"
		SHA256_7 = "5ca4a9f6553fea64ad2c724bf71d0fac2b372f9e7ce2200814c98aac647172fb"
		MD5_8 = "967fcf185634def5177f74b0f703bdc0"
		SHA256_8 = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
		MD5_9 = "c5d5cb99291fa4b2a68b5ea3ff9d9f9a"
		SHA256_9 = "65495d173e305625696051944a36a031ea94bb3a4f13034d8be740982bc4ab75"
		MD5_10 = "01d322dcac438d2bb6bce2bae8d613cb"
		SHA256_10 = "0c5ad1e8fe43583e279201cdb1046aea742bae59685e6da24e963a41df987494"
		MD5_11 = "8777a9796565effa01b03cf1cea9d24d"
		SHA256_11 = "83014ab5b3f63b0253cdab6d715f5988ac9014570fa4ab2b267c7cf9ba237d18"
		MD5_12 = "507bb551bd7073f846760d8b357b7aa9"
		SHA256_12 = "47cdb87c27c4e30ea3e2de620bed380d5aed591bc50c49b55fd43e106f294854"
	strings:
		$0 = "/home/ubuntu/GoProject/src/bot/botlib/chat.go"
		$1 = "/home/ubuntu/GoProject/src/bot/botlib.Post"
		$2 = "GoProject/src/bot/botlib.deleteFile"
		$3 = "ubuntu/GoProject/src/bot/botlib.generateRandomString"
		$4 = "GoProject/src/bot/botlib.AES_Decrypt"
		$5 = { 53 00 63 00 72 00 69 00 70 00 74 00 00 0F 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 00 07 2F 00 63 }
		$6 = { 3C 00 6E 00 77 00 3E 00 2E 00 2A 00 29 00 00 0B 24 00 7B 00 66 00 6E 00 7D }
		$7 = { 7B 00 61 00 72 00 67 00 7D 00 00 0B 24 00 7B 00 6E 00 77 00 7D }
		$8 = { 52 61 6E 64 6F 6D 53 74 72 69 6E 67 00 44 65 6C 65 74 65 46 69 6C 65 }
		$9 = "get_keyRC6"
		$10 = { 7D A3 26 77 1D 63 3D 5A 32 B4 6F 1F 55 49 44 25 }
		$11 = { 47 C2 2F 35 93 41 2F 55 73 0B C2 60 AB E1 2B 42 }
		$12 = { 53 58 9B 17 1F 45 BD 72 EC 01 30 6C 4F CA 93 1D }
		$13 = { 48 81 21 81 5F 53 3A 64 E0 ED FF 21 23 E5 00 12 }
		$14 = "GoProject/src/bot/botlib.wellMess"
		$15 = { 62 6F 74 6C 69 62 2E 4A 6F 69 6E 44 6E 73 43 68 75 6E 6B 73 }
		$16 = { 62 6F 74 6C 69 62 2E 45 78 65 63 }
		$17 = { 62 6F 74 6C 69 62 2E 47 65 74 52 61 6E 64 6F 6D 42 79 74 65 73 }
		$18 = { 62 6F 74 6C 69 62 2E 4B 65 79 }
		$19 = { 7F 16 21 9D 7B 03 CB D9 17 3B 9F 27 B3 DC 88 0F }
		$20 = { D9 BD 0A 0E 90 10 B1 39 D0 C8 56 58 69 74 15 8B }
		$21 = { 44 00 59 00 4A 00 20 00 36 00 47 00 73 00 62 00 59 00 31 00 2E }
		$22 = { 6E 00 20 00 46 00 75 00 7A 00 2C 00 4B 00 5A 00 20 00 33 00 31 00 69 00 6A 00 75 }
		$23 = { 43 00 31 00 69 00 76 00 66 00 39 00 32 00 20 00 56 00 37 00 6C 00 4F 00 48 }
		$24 = { 66 69 6C 65 4E 61 6D 65 3A 28 3F 50 3C 66 6E 3E 2E 2A 3F 29 5C 73 61 72 67 73 3A 28 3F 50 3C 61 72 67 3E 2E 2A 3F }
		$25 = { 5C 00 2E 00 53 00 61 00 6E 00 67 00 66 00 6F 00 72 00 55 00 44 00 2E 00 73 00 75 00 6D }
		$26 = { 66 6F 72 6D 2D 64 61 74 61 3B 20 6E 61 6D 65 3D 22 5F 67 61 22 3B 20 66 69 6C 65 6E 61 6D 65 3D }
		$27 = { 40 5B 5E 5C 73 5D 2B 3F 5C 73 28 3F 50 3C 74 61 72 3E 2E 2A 3F 29 5C 73 27 }
	condition:
		($0 and $1 and $2 and $3 and $4) or ($5 and $6 and $7 and $8 and $9) or ($10 and $11) or ($12 and $13) or ($14) or ($15 and $16 and $17 and $18) or ($19 and $20) or ($21 and $22 and $23) or ($24) or ($25 and $26) or ($27)
}