M-Trends: Advanced Persistent Threat Malware

There are a lot of reports in the news about the types of malware being utilized by the Advanced Persistent Threat (APT) attackers. Our upcoming release of M-Trends will go into great detail about the types of malware, its capabilities, and how the attackers leverage a variety of malware throughout a breadth of victim organizations to accomplish very specific goals. Over the next week, the MANDIANT blog will feature excerpts from our upcoming M-Trends report that illustrate just how difficult it is to identify APT techniques.

The most significant commonality of APT malware is that it hides in plain sight. It avoids detection by using common network ports, process injection and Windows service persistence. Every piece of APT malware cataloged by MANDIANT initiated only outbound network connections. No sample listened for inbound connections. So, unless an enterprise network is specifically monitoring outbound network traffic for APT-related anomalies, it will not identify the APT malware outbound beaconing attempts.

A few of the most poignant stats about APT malware are listed below:

APT Malware:

  • Average File Size: 121.85 KB

Most Common APT Filenames:

  • svchost.exe (most common)
  • iexplore.exe
  • iprinp.dll
  • wiinzf32.dll

APT Malware avoids anomaly detection through:

  • Outbound HTTP connections
  • Process injection
  • Service persistence

APT Malware Communication:

  • 100% of APT backdoors made only outbound connections
    • 83% used TCP port 80 or 443
    • 17% used another port

Because APT malware is so difficult to detect, simple malware signatures such as MD5 hashes, filenames, and traditional anti-virus methods usually yield a low rate of true positives. M-Trends will provide detailed information about how exactly organizations can posture themselves for success when fighting attackers with such specialized and sophisticated capabilities.

If you'd like to register for a copy of "M-Trends," drop us a note at info(at)mandiant(dot)com otherwise, keep your eyes peeled to our blog and http://www.mandiant.com for the official release of "M-Trends."

Special Thanks to Peter Silberman, the MANDIANT malware analysis team, and product engineers for their work in developing this information.