Ninja Correlation of APT Binaries

on YouTube ↗36m

" summary

Dataset of 25 APT white papers (Jan–Mar 2015) yields binaries from VirusTotal (>10% malicious) and compares three similarity methods: imphash, ssdeep, sdhash. imphash makes ~580 links with 408 true (low recall ~25%, ties mostly identical versions); ssdeep makes ~856 links with zero false positives (perfect precision) and links different versions; sdhash makes ~1,400 links with only three false positives and ~90% recall but requires expensive pairwise distances and stores bloom filters ~2–3% of file size.

AI-written summary · about

" chapters (5)

1. 0:00Start
2. 5:16WHAT IS THE BEST WAY TO
3. 8:59CHALLENGES
4. 9:48GATHERING DATA
5. 11:44SUMMARY RESULTS

" related talks

• 44mUnmasking APTs: An Automated Approach for Real-World Threat AttributionAakanksha Saha · Black Hat Europe 2023
• 40mDemystifying File Similarity for Malware DetectionUdbhav Prasad · BSidesSF 2026
• 25mEnhancing Malware Code Similarity Detection through Vectorsearch and TLSHRemco Sprooten · 2024 FIRST Cyber Threat Intelligence Conference
• 41mHow AI Is Changing the Malware LandscapeVicente Diaz · RSA Conference 2024
• 30mDeception at Scale: How Malware Abuses TrustGerardo Fernandez · Black Hat Asia 2023
• 30mTracking Threat Actors Using Images: A Hunting & Analysis ApproachJoseliyo S├ínchez · 2024 FIRST Cyber Threat Intelligence Conference
• 17mMapping the Connections Inside Russia’s APT EcosystemAri Eitan · BSidesSF 2020
• 22mAPT Attribution and DNS ProfilingFrankie Li · Black Hat USA 2014