I had to look up "Equation Group". A couple of articles mention that various malware tied to Equation Group includes timestamps indicating programmers working 8-5, Mon to Fri, in Eastern US timezones.

Anyone know of more info on why this would be left in? A simple oversight? False-flag propaganda?

Where would I look for more information on fingerprinting binaries? I.e. perhaps identifying compiler and even build environment.

Thanks!