EquationDrug
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Having originally uncovered the Equation group in February 2015, we’ve taken a look at the newly released files to check for any connections with the known toolsets used by Equation, such as EQUATIONDRUG, DOUBLEFANTASY, GRAYFISH and FANNY.
Techniques & procedures
30 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
4 techniquesBackdoor command is stored in the first byte of the decrypted request... 3 CallWinExec Disable Windows Audit and start new process via standard code injection in Winlogon.exe.
Next, the module injects extra code into a newly started target process. The injected code loads the payload DLL (“mscfg32.dll”) into the target process
The injection of code into winlogon.exe and services.exe ensures that the newly started process will have SYSTEM user privileges.
Persistence
4 techniquesThe driver also maintains a persistent list of protected objects that is stored in the following registry values... These values are also protected by the rootkit.
Magic Packet Recognition... Packets that passed through the filter are added in the end of processing queue... The backdoor command may arrive in a single packet or be split into pieces and come with several packets.
Privilege Escalation
2 techniquesNext, it crafts and injects a shellcode in “services.exe” or “winlogon.exe”. The shellcode is designed to spawn the loader process from the executable called “mscfg32.exe”.
Stealth
8 techniquesThe driver acts as the first stage of the EquationDrug platform on Windows 2000+ and implements rootkit functions for hiding the components of the platform.
Next, it crafts and injects a shellcode in “services.exe” or “winlogon.exe”. The shellcode is designed to spawn the loader process from the executable called “mscfg32.exe”.
Code Patcher The driver patches OS code to dynamically disable or enable Windows audit logging.
Panic Disable packet filtering, securely delete driver file, clear related registry keys, set ClearPageFileAtShutdown flag, unbind adapters, delete devices and prepare for unloading.
Magic Packet Recognition... Packets that passed through the filter are added in the end of processing queue... The backdoor command may arrive in a single packet or be split into pieces and come with several packets.
The rootkit code in the driver hooks several Native API functions that lets it hide or protect registry keys, files and running processes.
The rootkit code in the driver hooks several Native API functions that lets it hide or protect registry keys, files and running processes.
Defense Impairment
1 techniqueCredential Access
4 techniquesCollection of cached passwords.
Browser history, cached passwords and form auto-fill data collection.
Discovery
5 techniquesCollects system information: OS version, computer name, user name, locale, keyboard layout, timezone, process lists
Computer management: Start/stop processes Load drivers and libraries Manage files and directories
Browsing network resources and enumerating and accessing shares.
Lateral Movement
1 techniqueBrowsing network resources and enumerating and accessing shares.
Collection
5 techniquesThese include common features such as file collection and the making of screenshots.
Sophistication is added by storing stolen data inside a custom-encrypted virtual file system before it is sent to the command and control servers.
Command and Control
4 techniques8002 wshcom.dll C&C communication using Windows sockets ... 80CA wshapi.dll C&C communications interface via Windows sockets
EquationDrug Plugins: Plugin ID File name Description 800C perfcom.dll HTTP communication ... 80BE vnetapi.dll C&C communication via WinHTTP API
Passive network backdoor (runs Equation shellcode from raw traffic).
IOCs tracked for this family
26 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Known Equation Group malware/toolset referenced as part of Kaspersky’s prior findings and used for code-comparison against the ShadowBrokers leak, specifically around a rare RC5/RC6 implementation.
A modular cyberespionage platform used for long-term covert access, data theft, surveillance, and system management via numerous plugins. Capabilities include file collection, screenshots, network interception, password theft, browser monitoring, keylogging, removable media monitoring, NTFS access, and HDD/SSD firmware manipulation.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.