Overview

overview

8

Static

static

3

EqualizerA....2.exe

windows10-2004-x64

8

EqualizerA....2.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...ol.dll

windows10-2004-x64

3

$PLUGINSDI...ol.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...re.dll

windows10-2004-x64

3

$PLUGINSDI...re.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ay.dll

windows10-2004-x64

3

$PLUGINSDI...ay.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

Benchmark.exe

windows10-2004-x64

1

Benchmark.exe

windows11-ltsc_2024-x64

1

Configurat...e).url

windows10-2004-x64

1

Configurat...e).url

windows11-ltsc_2024-x64

1

Configurat...e).url

windows10-2004-x64

1

Configurat...e).url

windows11-ltsc_2024-x64

1

DeviceSelector.exe

windows10-2004-x64

7

DeviceSelector.exe

windows11-ltsc_2024-x64

7

Editor.exe

windows10-2004-x64

1

Editor.exe

windows11-ltsc_2024-x64

1

EqualizerAPO.dll

windows10-2004-x64

7

EqualizerAPO.dll

windows11-ltsc_2024-x64

7

Qt6Core.dll

windows10-2004-x64

1

Qt6Core.dll

windows11-ltsc_2024-x64

1

Qt6Gui.dll

windows10-2004-x64

1

Qt6Gui.dll

windows11-ltsc_2024-x64

1

Qt6Network.dll

windows10-2004-x64

1

Qt6Network.dll

windows11-ltsc_2024-x64

1

Resubmissions

03/08/2026, 22:53

260803-2t67xahb23

03/08/2026, 22:48

260803-2q485sha958

Sharing

Copy URL Twitter E-mail

General

  • Target
    EqualizerAPO-x64-1.4.2.exe
  • Size 11.4MB
  • Sample260803-2q485sha95
  • SHA256 7403be7427bbe1936a40dded082829b6e217fc4f5990fee5cba501f0ae055afa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryinstallerpersistenceprivilege_escalation

Malware Config

Targets

    • Target
      EqualizerAPO-x64-1.4.2.exe
    • Size 11.4MB
    • SHA256 7403be7427bbe1936a40dded082829b6e217fc4f5990fee5cba501f0ae055afa
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoverypersistenceprivilege_escalation

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/AccessControl.dll
    • Size 13KB
    • SHA256 933cadcd3a463484bbb3c45077afda0edbb539dfbe988efad79a88cae63bf95f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/NSISpcre.dll
    • Size 164KB
    • SHA256 43041f8540dccbc33268bfbef53037d17170b037f6393e77c21429f303ae828f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/StartMenu.dll
    • Size 7KB
    • SHA256 a6919f5f3b53a9c8c015413babe7a9872491a2583e49bb3c261e60785c3c3534
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/nsArray.dll
    • Size 12KB
    • SHA256 81745087f193b6fa131189f4b3ee9caa93e9692e408d3955fbcb9a4ec8516e2f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral13behavioral14
    • Target
      Benchmark.exe
    • Size 619KB
    • SHA256 ab9df4be7234c2574937f00fcd5cc7867fc3882b746499b6a7801d77f03984d3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      Configuration reference (online).url
    • Size 167B
    • SHA256 0386aba953d745c338636da1acba1941be7a5e18042ba74b63c6c047d17e75a2
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      Configuration tutorial (online).url
    • Size 169B
    • SHA256 f655030c56476500551b41bf2afd2545e728aa8674fd254700beeb0a21f1bb19
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      DeviceSelector.exe
    • Size 723KB
    • SHA256 3e9f638ead596084cf3484ab22822090fbe58979bbf18c16ac95828bb73d02ee
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    persistenceprivilege_escalation

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral21behavioral22
    • Target
      Editor.exe
    • Size 1.7MB
    • SHA256 77fd42c9eef32f5ab8d4feca0ddd7469d3850c9b443e47ad5b445a824adb78a2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24
    • Target
      EqualizerAPO.dll
    • Size 632KB
    • SHA256 fb73fc8b94f271464ae4f83918bb3cb3243c4f50a8035c07fa538ad16ad66aa4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    persistenceprivilege_escalation

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral25behavioral26
    • Target
      Qt6Core.dll
    • Size 6.0MB
    • SHA256 653a445d56044410903499952a2cc1ae575e059a75603a2b2a37b10d15db51f0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27behavioral28
    • Target
      Qt6Gui.dll
    • Size 8.0MB
    • SHA256 f710aab637560f64e759b2932fab383d01002436c73885a6d19b317e54d86bfc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29behavioral30
    • Target
      Qt6Network.dll
    • Size 3.8MB
    • SHA256 b9abac7aa2aa4598fdf93d4f69aec363d54cbe91331b23816158eed1c31b2a88
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

installer
Score
3/10

behavioral1

discoverypersistenceprivilege_escalation
Score
8/10

behavioral2

discovery
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

persistenceprivilege_escalation
Score
7/10

behavioral22

persistenceprivilege_escalation
Score
7/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

persistenceprivilege_escalation
Score
7/10

behavioral26

persistenceprivilege_escalation
Score
7/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10