APT19__2013__AdversaryIntelligenceReport_DeepPanda_0.pdf

### Executive summary This CrowdStrike Deep Panda report analyzes three malicious samples (a dropper, a .NET post-exploitation tool, and a C++ backdoor with a kernel-mode rootkit) used in targeted intrusions against high-value organizations; it documents technical behavior, network protocols and C2 infrastructure (including IPs and MD5s), persistence and anti-forensic techniques, mitigation signatures and artifacts, and provides attribution to a Chinese-speaking actor.