1. Home
  2. Software
  3. JHUHUGIT

JHUHUGIT

JHUHUGIT is malware used by APT28. It is based on Carberp source code and serves as reconnaissance malware. [1] [2] [3] [4]

ID: S0044
ⓘ
Associated Software: Trojan.Sofacy, Seduploader, JKEYSKW, Sednit, GAMEFISH, SofacyCarberp
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 2.2
Created: 31 May 2017
Last Modified: 11 April 2024

Associated Software Descriptions

Name Description
Trojan.Sofacy

This designation has been used in reporting both to refer to the threat group (Skeleton Key) and its associated malware.[5]
Seduploader

[4][6]
JKEYSKW

[4]
Sednit

This designation has been used in reporting both to refer to the threat group (APT28) and its associated malware.[4]
GAMEFISH

[4]
SofacyCarberp

[7]
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1546 .015 事件触发执行: Component Object Model Hijacking

JHUHUGIT has used COM hijacking to establish persistence by hijacking a class named MMDeviceEnumerator and also by registering the payload as a Shell Icon Overlay handler COM object ({3543619C-D563-43f7-95EA-4DA7E1CC396A}).[3][6]
Enterprise T1543 .003 创建或修改系统进程: Windows Service

JHUHUGIT has registered itself as a service to establish persistence.[3]
Enterprise T1115 剪贴板数据

A JHUHUGIT variant accesses a screenshot saved in the clipboard and converts it to a JPG image.[8]
Enterprise T1037 .001 启动或登录初始化脚本: Logon Script (Windows)

JHUHUGIT has registered a Windows shell script under the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.[3][6]
Enterprise T1547 .001 启动或登录自动启动执行: Registry Run Keys / Startup Folder

JHUHUGIT has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process.[3]
Enterprise T1059 .003 命令与脚本解释器: Windows Command Shell

JHUHUGIT uses a .bat file to execute a .dll.[6]
Enterprise T1008 回退信道

JHUHUGIT tests if it can reach its C2 server by first attempting a direct connection, and if it fails, obtaining proxy settings and sending the connection through a proxy, and finally injecting code into a running browser if the proxy method fails.[3]
Enterprise T1113 屏幕捕获

A JHUHUGIT variant takes screenshots by simulating the user pressing the "Take Screenshot" key (VK_SCREENSHOT), accessing the screenshot saved in the clipboard, and converting it to a JPG image.[8][6]
Enterprise T1071 .001 应用层协议: Web Protocols

JHUHUGIT variants have communicated with C2 servers over HTTP and HTTPS.[3][7][8]
Enterprise T1132 .001 数据编码: Standard Encoding

A JHUHUGIT variant encodes C2 POST data base64.[8]
Enterprise T1068 权限提升漏洞利用

JHUHUGIT has exploited CVE-2015-1701 and CVE-2015-2387 to escalate privileges.[3][9]
Enterprise T1027 .013 混淆文件或信息: Encrypted/Encoded File

Many strings in JHUHUGIT are obfuscated with a XOR algorithm.[2][3][6]
Enterprise T1070 .004 移除指标: File Deletion

The JHUHUGIT dropper can delete itself from the victim. Another JHUHUGIT variant has the capability to delete specified files.[3][7]
Enterprise T1218 .011 系统二进制代理执行: Rundll32

JHUHUGIT is executed using rundll32.exe.[2][6]
Enterprise T1082 系统信息发现

JHUHUGIT obtains a build identifier as well as victim hard drive information from Windows registry key HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum. Another JHUHUGIT variant gathers the victim storage volume serial number and the storage device name.[3][7]
Enterprise T1016 系统网络配置发现

A JHUHUGIT variant gathers network interface card information.[8]
Enterprise T1105 输入工具传输

JHUHUGIT can retrieve an additional payload from its C2 server.[3][7] JHUHUGIT has a command to download files to the victim’s machine.[6]
Enterprise T1057 进程发现

JHUHUGIT obtains a list of running processes on the victim.[3][7]
Enterprise T1055 进程注入

JHUHUGIT performs code injection injecting its own functions to browser processes.[2][7]
Enterprise T1053 .005 预定任务/作业: Scheduled Task

JHUHUGIT has registered itself as a scheduled task to run each time the current user logs in.[3][9]

Groups That Use This Software

ID Name References
G0007 APT28

[4][1][10][11][12]

References

  1. Kaspersky Lab's Global Research and Analysis Team. (2015, December 4). Sofacy APT hits high profile targets with updated toolset. Retrieved December 10, 2015.
  2. F-Secure. (2015, September 8). Sofacy Recycles Carberp and Metasploit Code. Retrieved August 3, 2016.
  3. ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016.
  4. FireEye iSIGHT Intelligence. (2017, January 11). APT28: At the Center of the Storm. Retrieved January 11, 2017.
  5. Symantec Security Response. (2018, October 04). APT28: New Espionage Operations Target Military and Government Organizations. Retrieved November 14, 2018.
  6. Mercer, W., et al. (2017, October 22). "Cyber Conflict" Decoy Document Used in Real Cyber Conflict. Retrieved November 2, 2018.
  1. Lee, B, et al. (2018, February 28). Sofacy Attacks Multiple Government Entities. Retrieved March 15, 2018.
  2. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.
  3. ESET Research. (2015, July 10). Sednit APT Group Meets Hacking Team. Retrieved March 1, 2017.
  4. Kaspersky Lab's Global Research & Analysis Team. (2018, February 20). A Slice of 2017 Sofacy Activity. Retrieved November 27, 2018.
  5. Brady, S . (2018, October 3). Indictment - United States vs Aleksei Sergeyevich Morenets, et al.. Retrieved October 1, 2020.
  6. Secureworks CTU. (2017, March 30). IRON TWILIGHT Supports Active Measures. Retrieved February 28, 2022.