Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
RAT

Equation

RAT Needs review 112 detections found
This entry hasn't been reviewed yet. It was auto-detected from the MITRE ATT&CK catalog because it self-identifies as rat-type malware, but no one has curated a full summary or double-checked its reference links. Treat the details below as a starting point, not a verified profile.

Also known as: Equation

Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (G0020) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's currently known; a proper summary and authoritative eradication references are pending.

Detection & eradication references

Curated links to authoritative sources — MITRE ATT&CK, CISA advisories, law-enforcement takedown announcements, and vendor threat-intel writeups — for removal, remediation, and further technical detail. Sigma Watch does not publish its own removal steps here, since malware behavior and tooling change too fast for a static write-up to stay reliably accurate.

Detection rules

Source Rule Status Updated
suricata ET EXPLOIT Equation Group EGREGIOUSBLUNDER Fortigate Exploit Attempt rev 7 2025-07-08
snort ET EXPLOIT Equation Group EGREGIOUSBLUNDER Fortigate Exploit Attempt rev 2 2025-07-08
sigma Network Connection Initiated By Eqnedt32.EXE test 2024-05-31
sigma Equation Group DLL_U Export Function Load stable 2023-03-09
sigma Suspicious Control Panel DLL Load test 2023-02-09
sigma Equation Group C2 Communication test 2021-11-27
sigma Equation Group Indicators test 2021-11-27
suricata ET EXPLOIT Equation Group ExtraBacon Cisco ASA AAAADMINAUTH Disable rev 1 2019-07-26
suricata ET EXPLOIT Equation Group ExtraBacon Cisco ASA PMCHECK Disable rev 1 2019-07-26
snort ET EXPLOIT Equation Group ExtraBacon Cisco ASA AAAADMINAUTH Disable rev 1 2016-08-17
snort ET EXPLOIT Equation Group ExtraBacon Cisco ASA PMCHECK Disable rev 1 2016-08-17
yara Equation_Kaspersky_FannyWorm — —
yara Equation_Kaspersky_HDD_reprogramming_module — —
yara Equation_Kaspersky_EOP_Package — —
yara Equation_Kaspersky_TripleFantasy_Loader — —
yara Equation_Kaspersky_SuspiciousString — —
yara apt_equation_keyword — —
yara EquationGroup_emptycriss — —
yara EquationGroup_scripme — —
yara EquationGroup_cryptTool — —
yara EquationGroup_dumppoppy — —
yara EquationGroup_Auditcleaner — —
yara EquationGroup_reverse_shell — —
yara EquationGroup_tnmunger — —
yara EquationGroup_ys_ratload — —
yara EquationGroup_eh_1_1_0 — —
yara EquationGroup_evolvingstrategy_1_0_1 — —
yara EquationGroup_toast_v3_2_0 — —
yara EquationGroup_sshobo — —
yara EquationGroup_magicjack_v1_1_0_0_client_1_1_0_0 — —
yara EquationGroup_packrat — —
yara EquationGroup_telex — —
yara EquationGroup_calserver — —
yara EquationGroup_porkclient — —
yara EquationGroup_electricslide — —
yara EquationGroup_libXmexploit2 — —
yara EquationGroup_wrap_telnet — —
yara EquationGroup_elgingamble — —
yara EquationGroup_cmsd — —
yara EquationGroup_ebbshave — —
yara EquationGroup_eggbasket — —
yara EquationGroup_jparsescan — —
yara EquationGroup_sambal — —
yara EquationGroup_pclean_v2_1_1_2 — —
yara EquationGroup_envisioncollision — —
yara EquationGroup_cmsex — —
yara EquationGroup_exze — —
yara EquationGroup_porkserver — —
yara EquationGroup_DUL — —
yara EquationGroup_slugger2 — —
yara EquationGroup_ebbisland — —
yara EquationGroup_jackpop — —
yara EquationGroup_parsescan — —
yara EquationGroup_jscan — —
yara EquationGroup_promptkill — —
yara EquationGroup_epoxyresin_v1_0_0 — —
yara EquationGroup_estopmoonlit — —
yara EquationGroup_envoytomato — —
yara EquationGroup_smash — —
yara EquationGroup_ratload — —
yara EquationGroup_ys — —
yara EquationGroup_ewok — —
yara EquationGroup_xspy — —
yara EquationGroup_estesfox — —
yara EquationGroup_elatedmonkey_1_0_1_1 — —
yara EquationGroup_scanner — —
yara EquationGroup__ftshell_ftshell_v3_10_3_0 — —
yara EquationGroup__scanner_scanner_v2_1_2 — —
yara EquationGroup__ghost_sparc_ghost_x86_3 — —
yara EquationGroup__pclean_v2_1_1_pclean_v2_1_1_4 — —
yara EquationGroup__jparsescan_parsescan_5 — —
yara EquationGroup__funnelout_v4_1_0_1 — —
yara EquationGroup__magicjack_v1_1_0_0_client — —
yara EquationGroup__ftshell — —
yara EquationGroup_store_linux_i386_v_3_3_0 — —
yara EquationGroup_morerats_client_genkey — —
yara EquationGroup_cursetingle_2_0_1_2_mswin32_v_2_0_1 — —
yara EquationGroup_cursesleepy_mswin32_v_1_0_0 — —
yara EquationGroup_porkserver_v3_0_0 — —
yara EquationGroup_cursehelper_win2k_i686_v_2_2_0 — —
yara EquationGroup_morerats_client_addkey — —
yara EquationGroup_watcher_solaris_i386_v_3_3_0 — —
yara EquationGroup_noclient_3_3_2 — —
yara EquationGroup_curseflower_mswin32_v_1_0_0 — —
yara EquationGroup_tmpwatch — —
yara EquationGroup_orleans_stride_sunos5_9_v_2_4_0 — —
yara EquationGroup_morerats_client_noprep — —
yara EquationGroup_cursezinger_linuxrh7_3_v_2_0_0 — —
yara EquationGroup_seconddate_ImplantStandalone_3_0_3 — —
yara EquationGroup_gr_dev_bin_now — —
yara EquationGroup_curseyo_win2k_v_1_0_0 — —
yara EquationGroup_gr — —
yara EquationGroup_curseroot_win2k_v_2_1_0 — —
yara EquationGroup_cursewham_curserazor_cursezinger_curseroot_win2k — —
yara EquationGroup_watcher_linux_i386_v_3_3_0 — —
yara EquationGroup_charm_saver_win2k_v_2_0_0 — —
yara EquationGroup_cursehappy_win2k_v_6_1_0 — —
yara EquationGroup_morerats_client_Store — —
yara EquationGroup_watcher_linux_x86_64_v_3_3_0 — —
yara EquationGroup_linux_exactchange — —
yara EquationGroup_x86_linux_exactchange — —
yara EquationGroup_gr_dev_bin_post — —
yara Equation_Kaspersky_GreyFishInstaller — —
yara apt_equation_exploitlib_mutexes — —
yara apt_equation_doublefantasy_genericresource — —
yara apt_equation_equationlaser_runtimeclasses — —
yara apt_equation_cryptotable — —
yara Equation_Kaspersky_TripleFantasy_1 — —
yara Equation_Kaspersky_DoubleFantasy_1 — —
yara Equation_Kaspersky_GROK_Keylogger — —
yara Equation_Kaspersky_EquationDrugInstaller — —
yara Equation_Kaspersky_EquationLaserInstaller — —