T1571 Non-Standard Port in real malware

ATT&CK technique T1571 Non-Standard Port appears in 140 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.1% of the analyzed corpus. Seven-day prevalence is rising (73 recent vs 64 prior). Most associated families: Upantix, HUILoader, Ulise, Gobot, Mirai.

Tactics: command-and-control

Prevalence in the corpus

• Samples exhibiting T1571: 140
• Share of analyzed corpus: 0.1%
• Last 7 days: 73 · prior 7 days: 64 (rising)

Malware families using T1571

• Upantix - 90 samples
• HUILoader - 37 samples
• Ulise - 4 samples
• Gobot - 2 samples
• Mirai - 2 samples
• Crypted - 1 sample

Example samples

• 5599812c846bf630def0c094526678ea0be08a4ece8811fa3470195b461d248e - malicious
• 8f7534bc35eef77421f8a2ba8ef6acea78f0adcb64c43db505b52f0e450adc76 - malicious
• f51838ec3c5d8c80c273b5db5392f00e478861e69dc249aedab4ff2c2be662a1 - malicious
• e59da8f9150f12c7277d98b60641d2ff110a144ea10a34d5c8dca71aa4c655c6 - malicious
• a204b66914a7a9fbb700400c7cb249015f1bbb6bbfc1b5b1a73f4e452bc65748 - malicious
• 5926b0ac363e9b036f4631c7f59b40f8c40199746e9f82a6fa5187f93c6945dc - malicious
• 9b2da7a06c299b17644dd6c39d2f4149c717708a4aaa217378a30329341a2b9c - malicious
• 2998b10e63ca51062d20ed9145b6ffd0f18cce0a4f4404cda2ab2f72c30b1cfd - malicious
• 650fea17d9b35bac50bffb51e47882dd28c5ea9db30211fdb9f87abd4462c0d2 - malicious
• 5c02d48e0e55ce59b3550f5d0b18c1f1def4040ef4e0b2b80f6a4ac4f29d0bd5 - malicious
• 9a92d318a401163d839130eb8ed244439b3b4518c365d06401963d6908e6a064 - malicious
• 8c3435c87304c6189dc8fd839867edb9cca804fbe07ae9db2b92563ee9c498ca - malicious
• c894ed71694fd28d60113b5594f9e61e5133a18f410960849e868b60b8beb973 - malicious
• 7e6393c9d4696e35e70d0c6eaee2e338bb2567debd950023176c25cf92289340 - malicious
• f9db7672616a09abf7dfd44133861fd191af1b41d833863f6d1a9ae642cf380e - malicious
• Doom 3 + fix.exe - malicious
• Sims 2 + cdfix.exe - malicious
• DAoC(trainer).exe - malicious
• BattleField 1942 + fix.exe - malicious
• BattleField 1942(nocd).exe - malicious
• BattleField 1942 fix.exe - malicious
• Doom 3_cheat.exe - malicious
• BattleField 1942_fix.exe - malicious
• Silent Hill 4 + nocd.exe - malicious
• FlatOut + hack.exe - malicious

Canonical technique definition: MITRE ATT&CK T1571 (ATT&CK v19.1, CC BY 4.0).

Frequently asked about T1571

How common is ATT&CK T1571 (Non-Standard Port) in real malware?

ATT&CK technique T1571 Non-Standard Port appears in 140 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.1% of the analyzed corpus. Seven-day prevalence is rising (73 recent vs 64 prior). Most associated families: Upantix, HUILoader, Ulise, Gobot, Mirai.

Is T1571 becoming more common?

Prevalence is rising: 73 samples in the last seven days against 64 in the seven days before. This measures submissions to MalwareAnalyzer by Cyble, so it reflects what is being submitted here rather than global attacker behaviour.

Which malware families use T1571?

In this corpus T1571 is most associated with Upantix (90), HUILoader (37), Ulise (4), Gobot (2), Mirai (2), Crypted (1). Counts are analyzed samples per family in which the technique was observed.

What share of analyzed samples use T1571?

0.1% of the publicly analyzed corpus (140 of 100981 samples) exhibits T1571. Technique attribution comes from behavior captured during real sandbox detonation and from static analysis, not from a vendor label.

All ATT&CK techniques in the corpus · Latest analyzed threats