← Back to SOC feed Coverage →

Equation Group Malware - EoP package and malware launcher

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-05-23T11:00:00Z · Confidence: medium

Hunt Hypothesis

The detection identifies potential Equation Group malware activity involving an EoP package and a launcher, which may indicate advanced persistent threat infrastructure. SOC teams should proactively hunt for this behavior to uncover stealthy, long-term adversary presence in their Azure Sentinel environment.

YARA Rule

rule Equation_Kaspersky_EOP_Package 
{

    meta:
        description = "Equation Group Malware - EoP package and malware launcher"
        author = "Florian Roth"
        reference = "http://goo.gl/ivt8EW"
        date = "2015/02/16"
        hash = "2bd1b1f5b4384ce802d5d32d8c8fd3d1dc04b962"

    strings:
        $mz = { 4d 5a }
        $s0 = "abababababab" fullword ascii
        $s1 = "abcdefghijklmnopq" fullword ascii
        $s2 = "@STATIC" fullword wide
        $s3 = "$aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" fullword ascii
        $s4 = "@prkMtx" fullword wide
        $s5 = "prkMtx" fullword wide
        $s6 = "cnFormVoidFBC" fullword wide

    condition:
        ( $mz at 0 ) and filesize < 100000 and all of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 8 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/APT_Equation.yar