APT Malware Dataset

This dataset contains over 3,500 malware samples that are related to 12 APT groups which alledgedly are sponsored by 5 different nation-states. This dataset was used for benchmarking different Machine Learning approaches performing authorship attribution. This dataset can be used for future benchmarks or malware research.

Data Characteristics

The samples in the dataset are distributed as follows:

Country | APT Group | Family | Requested | Downloaded --- | --- | --- | ---: | ---: China | APT 1 | | 1007 | 405 China | APT 10 | i.a. PlugX | 300 | 244 China | APT 19 | Derusbi | 33 | 32 China | APT 21 | TravNet | 118 | 106 Russia | APT 28 | Bears | 230 | 214 Russia | APT 29 | Dukes | 281 | 281 China | APT 30 | | 164 | 164 North-Korea | DarkHotel | DarkHotel | 298 | 273 Russia | Energetic Bear | Havex | 132 | 132 USA | Equation Group | Fannyworm | 395 | 395 Pakistan | Gorgon Group | Different RATs | 1085 | 961 China | Winnti | | 406 | 387 Total ||| 4449 | 3594

Remarks

All samples are named according to their SHA-256 hash and grouped by APT group. Samples are put in separate password-protected compressed folders (.zip). The password for all files is infected.

Source

The malware samples are collected using open source threat intelligence reports from multiple vendors. Many threat intelligence reports were collected and a list of all filehashes used as indicators of compromise (IoC) has been collected. These hashes were used to obtain the malware samples from VirusTotal.

The file overview.csv contains an overview of all malware samples and the reports in which their hash-value has been found.

Code Used for Authorship Attribution

The source code of the experiments performed for benchmarking authorship attribution performance can be found at GitHub: APT Attribution Code.

License

Open Database License

This APT Malware Dataset is made available under Open Database License whose full text can be found at http://opendatacommons.org/licenses/odbl/. Any rights in individual contents of the database are licensed under the Database Contents License whose text can be found http://opendatacommons.org/licenses/dbcl/.