EquationDrug
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Having originally uncovered the Equation group in February 2015, we’ve taken a look at the newly released files to check for any connections with the known toolsets used by Equation, such as EQUATIONDRUG, DOUBLEFANTASY, GRAYFISH and FANNY.
Techniques & procedures
30 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
4 techniques
Execution
Backdoor command is stored in the first byte of the decrypted request... 3 CallWinExec Disable Windows Audit and start new process via standard code injection in Winlogon.exe.
Persistence
4 techniques
Persistence
The driver also maintains a persistent list of protected objects that is stored in the following registry values... These values are also protected by the rootkit.
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
8 techniques
Stealth
The driver acts as the first stage of the EquationDrug platform on Windows 2000+ and implements rootkit functions for hiding the components of the platform.
Next, it crafts and injects a shellcode in “services.exe” or “winlogon.exe”. The shellcode is designed to spawn the loader process from the executable called “mscfg32.exe”.
Code Patcher The driver patches OS code to dynamically disable or enable Windows audit logging.
Panic Disable packet filtering, securely delete driver file, clear related registry keys, set ClearPageFileAtShutdown flag, unbind adapters, delete devices and prepare for unloading.
Magic Packet Recognition... Packets that passed through the filter are added in the end of processing queue... The backdoor command may arrive in a single packet or be split into pieces and come with several packets.
Defense Impairment
1 technique
Defense Impairment
Credential Access
4 techniques
Credential Access
Discovery
5 techniques
Discovery
Lateral Movement
1 technique
Lateral Movement
Collection
5 techniques
Collection
Command and Control
4 techniques
Command and Control
8002 wshcom.dll C&C communication using Windows sockets ... 80CA wshapi.dll C&C communications interface via Windows sockets
IOCs tracked for this family
27 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Known Equation Group malware/toolset referenced as part of Kaspersky’s prior findings and used for code-comparison against the ShadowBrokers leak, specifically around a rare RC5/RC6 implementation.
A modular cyberespionage platform used for long-term covert access, data theft, surveillance, and system management via numerous plugins. Capabilities include file collection, screenshots, network interception, password theft, browser monitoring, keylogging, removable media monitoring, NTFS access, and HDD/SSD firmware manipulation.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.