New Malware Takes ‘Extended Naps’ To Avoid Detection

A FireEye report describes 'Trojan Nap', a Trojan Horse that uses a SleepEx() function to perform extended sleep cycles (default 600,000 ms / 10 minutes) to evade behavior-based detection and automated analysis; it also uses a fast-flux command-and-control network with domains observed on hosts in Latvia, Ukraine, Taiwan, Kazakhstan, and Pittsburgh, PA, and its dormancy mirrors APT-style tactics that complicate detection and attribution.