EquationDrug malware family
EquationDrug is a malware family tracked by MalwareAnalyzer by Cyble across 3 publicly analyzed samples. First seen 2026-07-29, most recently 2026-08-08. Observed ATT&CK techniques include T1057, T1112, T1105.
Corpus statistics
- Publicly analyzed samples: 3
- First seen: 2026-07-29
- Last seen: 2026-08-08
- Verdicts: malicious 3
- File types: pe 3
ATT&CK techniques used by EquationDrug
Recent EquationDrug samples
- FannyWorm_002F5E401F705FE91F44263E49D6C216 - malicious (2026-08-08)
- 380_EquationGroup.bin - malicious (2026-07-31)
- EquationDrug_4556CE5EB007AF1DE5BD3B457F0B216D - malicious (2026-07-29)
Frequently asked about EquationDrug
- What is EquationDrug?
- EquationDrug is a malware family tracked by MalwareAnalyzer by Cyble across 3 publicly analyzed samples. First seen 2026-07-29, most recently 2026-08-08. Observed ATT&CK techniques include T1057, T1112, T1105.
- How many EquationDrug samples have been analyzed?
- MalwareAnalyzer by Cyble holds 3 publicly analyzed samples attributed to EquationDrug, first seen 2026-07-29 and most recently 2026-08-08. This counts public submissions to this platform only, so it is a measure of what we have seen rather than of the family's total prevalence.
- What MITRE ATT&CK techniques does EquationDrug use?
- Across our EquationDrug samples the most frequently observed techniques are T1057 (2), T1112 (2), T1105 (1). Counts are the number of analyzed samples in which each technique was observed.
- What file types does EquationDrug use?
- EquationDrug samples in this corpus are distributed as pe (3).
- Is EquationDrug malicious?
- 3 of 3 analyzed EquationDrug samples were scored malicious by the fused verdict, which combines multi-engine static scanning, YARA and hash reputation with behavior captured during real sandbox detonation. Each report lists every signal that contributed to its score.
Latest analyzed threats · ATT&CK coverage across the corpus · Threat trends