Patent ID: 9548988
Date: 2017-01-17
CPC Classifications: G06F,H04L

Claim:
1. A computer-implemented method for attributing potentially malicious email campaigns to known threat groups, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying a potentially malicious email campaign targeting at least one organization; detecting an attachment within at least one email included in the potentially malicious email campaign; executing the attachment detected within the email included in the potentially malicious email campaign; determining that, upon execution, the attachment causes a remote download of malicious code; executing at least a portion of the malicious code whose remote download was caused by the attachment; observing, while executing the portion of the malicious code, at least one dynamic characteristic of the malicious code, wherein the dynamic characteristic of the malicious code comprises contacting a Command and Control (C&C) domain during execution of the malicious code; determining that the C&C domain has been linked to a known threat group; determining, based at least in part on the C&C domain being linked to the known threat group, that the known threat group is likely responsible for the potentially malicious email campaign; in response to determining that the known threat group is likely responsible for the potentially malicious email campaign, attributing the potentially malicious email campaign to the known threat group.