← Back to SOC feed Coverage →

Detects tool from EQGRP toolset - from files 1212.pl, dehex.pl

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-05-22T11:00:00Z · Confidence: medium

Hunt Hypothesis

The hypothesis is that the presence of 1212.pl and dehex.pl files indicates potential exploitation by the EQGRP group, which may be used for data exfiltration or command and control activities. SOC teams should proactively hunt for these files in Azure Sentinel to identify early signs of compromise from known malicious toolsets.

YARA Rule

rule EQGRP_1212_dehex 
{

    meta:
        description = "Detects tool from EQGRP toolset - from files 1212.pl, dehex.pl"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-15"

    strings:
        $s1 = "return \"ERROR:$line is not a valid address\";" fullword ascii
        $s2 = "print \"ERROR: the filename or hex representation needs to be one argument try using \\\"'s\\n\";" fullword ascii
        $s3 = "push(@octets,$byte_table{$tempi});" fullword ascii
        $s4 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii
        $s5 = "print hextoIP($ARGV[0]);" fullword ascii

    condition:
        ( uint16(0) == 0x2123 and filesize < 6KB and ( 5 of ($s*) ) ) or ( all of them )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 5 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/APT_EQUATIONGRP.yar