nneonneo / eqgrp-free-file

Free sampling of files from the purported Equation Group hack.

About

This repository contains the decrypted and decompressed contents of the eqgrp-free-file.tar.xz file released by "The Shadow Brokers". The contents are supposedly a free sample of the files exfiltrated from the Equation Group, a notorious, highly-sophisticated cyber attack group.

The Shadow Brokers have opened an auction to sell off the remaining files, although the legitimacy of the auction is widely disputed. See the original auction announcement here: https://theshadowbrokers.tumblr.com/post/148872852770/equation-group-cyber-weapons-auction-invitation

Only files in the Firewall directory are from the archive. listing.txt shows a list of all the files in the original archive, along with their file date and timestamps.

Disclaimers

This repository is provided as an educational resource to researchers wanting to validate the claims of the Shadow Brokers, as well as anyone wanting to study code potentially originating from a powerful threat actor. Needless to say, this repository may contain extremely malicious code, and I (@nneonneo) disclaim any responsibility for what may happen with your use or misuse of this software.

The code does not belong to me, but the author of the code is unknown and is very unlikely to step up to enforce any copyright claims. Nevertheless, if takedown is warranted I will gladly remove the repository.

eqgrp-free-file's Issues

Content of repository possibly breaks new github community guidelines

According to the new in development github community guidelines links to active malware or exploits are not allowed. A exception is made for source code as it serves a education value.

However the files inside this repository are not source code and are direct malicious executable's hence the do not comply with github there new rules (sadly).

Quote from guidelines:
Active malware or exploits - Being part of a community includes not taking advantage of other members of the community. We do not allow anyone to use our platform for exploit delivery, such as hosting malicious executables, or as attack infrastructure, for example by organizing denial of service attacks or managing command and control servers. Note, however, that we do not prohibit the posting of source code which could be used to develop malware or exploits, as the publication and distribution of such source code has educational value and provides a net benefit to the security community.

the new community guidelines are however still up for debate so I recommend raising our voice now while we still can. you can do so here: https://github.com/contact/community-guidelines

For a complete list of the new community guidelines see: https://help.github.com/articles/github-community-guidelines/#what-is-not-allowed