Unit 42 Sofacy Feb 2018

APT28 encrypted a .dll payload using RTL and a custom encryption algorithm. APT28 has also obfuscated payloads with base64, XOR, and RC4.

JHUHUGIT performs code injection injecting its own functions to browser processes.

JHUHUGIT obtains a list of running processes on the victim.

The JHUHUGIT dropper can delete itself from the victim. Another JHUHUGIT variant has the capability to delete specified files.

JHUHUGIT variants have communicated with C2 servers over HTTP and HTTPS.

JHUHUGIT can retrieve an additional payload from its C2 server. JHUHUGIT has a command to download files to the victim’s machine.

An APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.

APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts.

APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments.

JHUHUGIT obtains a build identifier as well as victim hard drive information from Windows registry key HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum. Another JHUHUGIT variant gathers the victim storage volume serial number and the storage device name.