← Back to SOC feed Coverage →

Chinese Hacktool Set - file DTools.exe

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-15T11:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies the presence of DTools.exe, a component of the Chinese Hacktool suite often associated with reconnaissance and lateral movement activities by advanced persistent threat actors targeting government or critical infrastructure sectors. Proactively hunting for this artifact in Azure Sentinel is essential to validate its legitimacy against baseline inventory, as its low severity classification may cause it to be overlooked during routine alert triage despite its potential role in early-stage intrusion campaigns.

YARA Rule

rule DTools2_02_DTools {
	meta:
		description = "Chinese Hacktool Set - file DTools.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "9f99771427120d09ec7afa3b21a1cb9ed720af12"
	strings:
		$s0 = "kernel32.dll" ascii
		$s1 = "TSETPASSWORDFORM" fullword wide
		$s2 = "TGETNTUSERNAMEFORM" fullword wide
		$s3 = "TPORTFORM" fullword wide
		$s4 = "ShellFold" fullword ascii
		$s5 = "DefaultPHotLigh" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 6 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file DTools.exe detection rule, along with recommended filters and exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/TOOLKIT_Chinese_Hacktools.yar