← Back to SOC feed Coverage →

Chinese Hacktool Set - file epathobj_exp64.exe

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-18T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt investigates the presence of epathobj_exp64.exe, a known component of the Chinese Hacktool suite often associated with advanced persistent threat reconnaissance and lateral movement activities. Proactively searching for this artifact in Azure Sentinel is critical to identify early-stage adversary footholds that may evade standard signature-based detections due to their legitimate tooling origins.

YARA Rule

rule epathobj_exp64 {
	meta:
		description = "Chinese Hacktool Set - file epathobj_exp64.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "09195ba4e25ccce35c188657957c0f2c6a61d083"
	strings:
		$s1 = "Watchdog thread %d waiting on Mutex" fullword ascii
		$s2 = "Exploit ok run command" fullword ascii
		$s3 = "\\epathobj_exp\\x64\\Release\\epathobj_exp.pdb" fullword ascii
		$s4 = "Alllocated userspace PATHRECORD () %p" fullword ascii
		$s5 = "Mutex object did not timeout, list not patched" fullword ascii
		$s6 = "- inconsistent onexit begin-end variables" fullword wide  /* Goodware String - occured 96 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 150KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 6 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set detection rule regarding epathobj_exp64.exe, along with suggested filters or exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/TOOLKIT_Chinese_Hacktools.yar