APT Attribution and DNS Profiling
summary
Claims that APT operators maintain stable DNS‑IP pairs and register many themed domains (often Pinyin domain naming), based on manual and passive DNS/WHOIS queries over roughly 20 samples; finds redundancy (multiple DNS names per campaign) and reuse of parked IP space rather than fast‑flux. Built an automated scraper and database called Malprofile + Maltego (Malpova demo on Google Code), uses VirusTotal, DomainTools and bgp.he.net; results are suggestive and visualizable but not definitive attribution.
AI-written summary · about
chapters (6)
- 0:00Start
- 0:23APT Attribution: Who wrote these codes? • Tactics, Techniques and Procedures (TTP) • Behavior of APT adversary • HUMINT extracted from DNS or Whois . Gather intelligence from open source • Dynamically monitoring of PassiveDNS Passive Whois • Analysis by visualization tool (Maltego) • Mal Profile Tools and demo
- 4:40Source code attribution • Attributes of Windows binaries • Attribution malware • Attribution of APT by digital DNA
- 9:40TTP OR BEHAVIOR OF APT ADVERSARY
- 14:37Extract DNS from the malicious code sandbox • Lookup the currently assigned IP address • Retrieve all parked-domains from the identified IP address • Retrieve whois information from the identified domains • Update identified record to a relational database for future analysis • Repeat the process and record all changes in the database
- 17:34ANALYSIS BY VISUALIZATION MALTEGO
related talks
32mSomething’s Phishy: See the Hook Before the Bait
44mUnmasking APTs: An Automated Approach for Real-World Threat Attribution
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
52mInvestigating DDOS - Architecture Actors and Attribution
47mDNS On Fire
32mOperation Clairvoyance: How APT Groups Spy on the Media Industry
58mMultivariate Solutions To Emerging Passive DNS Challenges
47mDetecting and analyzing files-less malware