  Malware allegedly developed by nation-states, also known as advanced
persistent threats (APT), are becoming more common. The task of attributing an
APT to a specific nation-state or classifying it to the correct APT family is
challenging for several reasons. First, each nation-state has more than a
single cyber unit that develops such malware, rendering traditional authorship
attribution algorithms useless. Furthermore, the dataset of such available APTs
is still extremely small. Finally, those APTs use state-of-the-art evasion
techniques, making feature extraction challenging. In this paper, we use a deep
neural network (DNN) as a classifier for nation-state APT attribution. We
record the dynamic behavior of the APT when run in a sandbox and use it as raw
input for the neural network, allowing the DNN to learn high level feature
abstractions of the APTs itself. We also use the same raw features for APT
family classification. Finally, we use the feature abstractions learned by the
APT family classifier to solve the attribution problem. Using a test set of
1000 Chinese and Russian developed APTs, we achieved an accuracy rate of 98.6%.
