Trojan.Sofacy.APT
Short bio
Trojan.Sofacy.APT is Malwarebytes' detection name for a Trojan that is used by the group known as APT28 or Sofacy.
Type and source of infection
Trojan.Sofacy.APT is a Trojan that is used in highly targeted attacks. Trojan.Sofacy.APT gathers information about the affected system and sends it to a C2 server.
Protection
Malwarebytes blocks Trojan.Sofacy.APT
Home remediation
Malwarebytes can detect and remove Trojan.Sofacy.APT without further user interaction.
- Please download Malwarebytes to your desktop.
- Double-click MBSetup.exe and follow the prompts to install the program.
- When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
- Click on the Get started button.
- Click Scan to start a Threat Scan.
- Click Quarantine to remove the found threats.
- Reboot the system if prompted to complete the removal process.
Business remediation
How to remove Trojan.Sofacy.APT with the Malwarebytes Nebula console
You can use the Malwarebytes Anti-Malware Nebula console to scan endpoints.
Nebula endpoint tasks menu
On the Quarantine page you can see which threats were quarantined and restore them if necessary.
IOCs
C2 Domain: updaterweb.comSHA-256 hash: ae0bc3358fef0ca2a103e694aa556f55a3fed4e98ba57d16f5ae7ad4ad583698
Files: %TEMP%\fvjoik.dll %LOCALAPPDATA%\microsoft\terminalserverclient\termsrvclt.dll