Malware: JHUHUGIT

Description

[JHUHUGIT](https://attack.mitre.org/software/S0044) is malware used by [APT28](https://attack.mitre.org/groups/G0007). It is based on Carberp source code and serves as reconnaissance malware. (Citation: Kaspersky Sofacy) (Citation: F-Secure Sofacy 2015) (Citation: ESET Sednit Part 1) (Citation: FireEye APT28 January 2017)

External References

• mitre-attack
• ESET Sednit Part 1
• F-Secure Sofacy 2015
• FireEye APT28 January 2017
• Kaspersky Sofacy
• Unit 42 Sofacy Feb 2018
• Talos Seduploader Oct 2017
• Symantec APT28 Oct 2018

Techniques Used by This Malware

• T1008 — Fallback Channels
• T1016 — System Network Configuration Discovery
• T1027.013 — Encrypted/Encoded File
• T1037.001 — Logon Script (Windows)
• T1053.005 — Scheduled Task
• T1055 — Process Injection
• T1057 — Process Discovery
• T1059.003 — Windows Command Shell
• T1068 — Exploitation for Privilege Escalation
• T1070.004 — File Deletion
• T1071.001 — Web Protocols
• T1082 — System Information Discovery
• T1105 — Ingress Tool Transfer
• T1113 — Screen Capture
• T1115 — Clipboard Data
• T1132.001 — Standard Encoding
• T1218.011 — Rundll32
• T1543.003 — Windows Service
• T1546.015 — Component Object Model Hijacking
• T1547.001 — Registry Run Keys / Startup Folder

APT Groups Using This Malware

• APT28