Skip to content

S0044 JHUHUGIT

JHUHUGIT is malware used by APT28. It is based on Carberp source code and serves as reconnaissance malware. 1 2 3 4

Item Value
ID S0044
Associated Names Trojan.Sofacy, Seduploader, JKEYSKW, Sednit, GAMEFISH, SofacyCarberp
Type MALWARE
Version 2.1
Created 31 May 2017
Last Modified 30 March 2020
Navigation Layer View In ATT&CK® Navigator

Associated Software Descriptions

Name Description
Trojan.Sofacy This designation has been used in reporting both to refer to the threat group (Skeleton Key) and its associated malware.5
Seduploader 46
JKEYSKW 4
Sednit This designation has been used in reporting both to refer to the threat group (APT28) and its associated malware.4
GAMEFISH 4
SofacyCarberp 7

Techniques Used

Domain ID Name Use
enterprise T1071 Application Layer Protocol -
enterprise T1071.001 Web Protocols JHUHUGIT variants have communicated with C2 servers over HTTP and HTTPS.378
enterprise T1547 Boot or Logon Autostart Execution -
enterprise T1547.001 Registry Run Keys / Startup Folder JHUHUGIT has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process.3
enterprise T1037 Boot or Logon Initialization Scripts -
enterprise T1037.001 Logon Script (Windows) JHUHUGIT has registered a Windows shell script under the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.36
enterprise T1115 Clipboard Data A JHUHUGIT variant accesses a screenshot saved in the clipboard and converts it to a JPG image.8
enterprise T1059 Command and Scripting Interpreter -
enterprise T1059.003 Windows Command Shell JHUHUGIT uses a .bat file to execute a .dll.6
enterprise T1543 Create or Modify System Process -
enterprise T1543.003 Windows Service JHUHUGIT has registered itself as a service to establish persistence.3
enterprise T1132 Data Encoding -
enterprise T1132.001 Standard Encoding A JHUHUGIT variant encodes C2 POST data base64.8
enterprise T1546 Event Triggered Execution -
enterprise T1546.015 Component Object Model Hijacking JHUHUGIT has used COM hijacking to establish persistence by hijacking a class named MMDeviceEnumerator and also by registering the payload as a Shell Icon Overlay handler COM object ({3543619C-D563-43f7-95EA-4DA7E1CC396A}).36
enterprise T1068 Exploitation for Privilege Escalation JHUHUGIT has exploited CVE-2015-1701 and CVE-2015-2387 to escalate privileges.39
enterprise T1008 Fallback Channels JHUHUGIT tests if it can reach its C2 server by first attempting a direct connection, and if it fails, obtaining proxy settings and sending the connection through a proxy, and finally injecting code into a running browser if the proxy method fails.3
enterprise T1070 Indicator Removal -
enterprise T1070.004 File Deletion The JHUHUGIT dropper can delete itself from the victim. Another JHUHUGIT variant has the capability to delete specified files.37
enterprise T1105 Ingress Tool Transfer JHUHUGIT can retrieve an additional payload from its C2 server.37 JHUHUGIT has a command to download files to the victim’s machine.6
enterprise T1027 Obfuscated Files or Information Many strings in JHUHUGIT are obfuscated with a XOR algorithm.236
enterprise T1057 Process Discovery JHUHUGIT obtains a list of running processes on the victim.37
enterprise T1055 Process Injection JHUHUGIT performs code injection injecting its own functions to browser processes.27
enterprise T1053 Scheduled Task/Job -
enterprise T1053.005 Scheduled Task JHUHUGIT has registered itself as a scheduled task to run each time the current user logs in.39
enterprise T1113 Screen Capture A JHUHUGIT variant takes screenshots by simulating the user pressing the “Take Screenshot” key (VK_SCREENSHOT), accessing the screenshot saved in the clipboard, and converting it to a JPG image.86
enterprise T1218 System Binary Proxy Execution -
enterprise T1218.011 Rundll32 JHUHUGIT is executed using rundll32.exe.26
enterprise T1082 System Information Discovery JHUHUGIT obtains a build identifier as well as victim hard drive information from Windows registry key HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum. Another JHUHUGIT variant gathers the victim storage volume serial number and the storage device name.37
enterprise T1016 System Network Configuration Discovery A JHUHUGIT variant gathers network interface card information.8

Groups That Use This Software

ID Name References
G0007 APT28 41101112

References

  1. Kaspersky Lab’s Global Research and Analysis Team. (2015, December 4). Sofacy APT hits high profile targets with updated toolset. Retrieved December 10, 2015. ↩↩

  2. F-Secure. (2015, September 8). Sofacy Recycles Carberp and Metasploit Code. Retrieved August 3, 2016. ↩↩↩↩

  3. ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩

  4. FireEye iSIGHT Intelligence. (2017, January 11). APT28: At the Center of the Storm. Retrieved January 11, 2017. ↩↩↩↩↩↩

  5. Symantec Security Response. (2018, October 04). APT28: New Espionage Operations Target Military and Government Organizations. Retrieved November 14, 2018. ↩

  6. Mercer, W., et al. (2017, October 22). “Cyber Conflict” Decoy Document Used in Real Cyber Conflict. Retrieved November 2, 2018. ↩↩↩↩↩↩↩↩

  7. Lee, B, et al. (2018, February 28). Sofacy Attacks Multiple Government Entities. Retrieved March 15, 2018. ↩↩↩↩↩↩↩

  8. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017. ↩↩↩↩↩

  9. ESET Research. (2015, July 10). Sednit APT Group Meets Hacking Team. Retrieved March 1, 2017. ↩↩

  10. Kaspersky Lab’s Global Research & Analysis Team. (2018, February 20). A Slice of 2017 Sofacy Activity. Retrieved November 27, 2018. ↩

  11. Brady, S . (2018, October 3). Indictment - United States vs Aleksei Sergeyevich Morenets, et al.. Retrieved October 1, 2020. ↩

  12. Secureworks CTU. (2017, March 30). IRON TWILIGHT Supports Active Measures. Retrieved February 28, 2022. ↩