MALICIOUS — 380_EquationGroup.bin

MALICIOUS — 380_EquationGroup.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the EquationDrug family. 7 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 4235bade21de41e79d3f60ca0877cb6b88257a62c4b8b07948ee20fec7901c05
• SHA-1: 9b70a232fd4524cf0759253f8d50d984ea005562
• MD5: 939706730193e6bcfeb991de4387bd3f
• imphash: 6c22181c4a122990e7c1d1ef45848e30
• ssdeep: 3072:TtnUNALmVZvvGBeQYejpuIAq2tn2TBfki43y97FozS4Oq1sqH73oGC:p4LvkwejpEqun2TB8i4i0zLOosqHkG
• TLSH: T11A419D178330A548D2E6EB717482BC0CD167F5CDB2B2BADB40E582BC6EE44277425A17
• Submitted as: 380_EquationGroup.bin
• File type: pe · Size: 184320 bytes
• Verdict: malicious (100/100) · Family: EquationDrug

Detections (7 of 52 engines)

• ClamAV (daily): {MD5}bin.trojan.alhw.7757.UNOFFICIAL
• YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: TrojanDownloader:Win32/Eqtonapt.A!dha
• Emsisoft (Emergency Kit): Trojan.Dropper.SRY
• Trellix Stinger (McAfee): Trojan-FFTB!939706730193
• Kaspersky (KVRT): Trojan.Win32.EquationDrug.n

MITRE ATT&CK

• T1057

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

• ClamAV (daily) flagged {MD5}bin.trojan.alhw.7757.UNOFFICIAL (rule {MD5}bin.trojan.alhw.7757.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged TrojanDownloader:Win32/Eqtonapt.A!dha (rule TrojanDownloader:Win32/Eqtonapt.A!dha) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Dropper.SRY (rule Trojan.Dropper.SRY) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Trojan-FFTB!939706730193 (rule Trojan-FFTB!939706730193) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Trojan.Win32.EquationDrug.n (rule Trojan.Win32.EquationDrug.n) - engine signal, weight 0.55, confidence 0.85
• Memory forensics: 4 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
• YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

• none

Dropped files

• /opt/CAPEv2/storage/analyses/6071/files/787419d07f4bda9bc91072bb8644ed943089ad44f4bb5920bfe452dc111c244d - 787419d07f4bda9bc91072bb8644ed943089ad44f4bb5920bfe452dc111c244d
• /opt/CAPEv2/storage/analyses/6071/files/6eb00b34d1daffa49b2f4c90841705b2c994563bde672bf35eb1c46cdb19a1ed - 6eb00b34d1daffa49b2f4c90841705b2c994563bde672bf35eb1c46cdb19a1ed
• /opt/CAPEv2/storage/analyses/6071/files/c69a9157638e69fb692d827383c3f27e586e0c98989cffdf8bd4c982ad837a4c - c69a9157638e69fb692d827383c3f27e586e0c98989cffdf8bd4c982ad837a4c

File paths

• c:\windows\system32\kernel32.dll
• d:\fanny.bmp
• x:\fanny.bmp
• Q:\__

More EquationDrug samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report