Chinese Hacktool Set - file lamescan3.exe

Hunt Hypothesis

This hunt targets adversaries deploying the lamescan3.exe reconnaissance tool to map network topology and identify vulnerable hosts within the Azure environment. Proactively searching for this artifact is critical because its presence often signals early-stage information gathering by Chinese threat actors that may precede more aggressive lateral movement or data exfiltration campaigns.

YARA Rule

rule lamescan3 {
	meta:
		description = "Chinese Hacktool Set - file lamescan3.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "3130eefb79650dab2e323328b905e4d5d3a1d2f0"
	strings:
		$s1 = "dic\\loginlist.txt" fullword ascii
		$s2 = "Radmin.exe" fullword ascii
		$s3 = "lamescan3.pdf!" fullword ascii
		$s4 = "dic\\passlist.txt" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 3740KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file lamescan3.exe detection rule in an enterprise environment:

Scheduled Endpoint Security Scans by Third-Party AV
- Scenario: The organization utilizes a Chinese-origin endpoint protection suite (e.g., Trend Micro Deep Security, Kingsoft Enterprise Antivirus, or Qihoo 360 Total Security) deployed across the engineering workstations. During off-hours, these agents execute a deep heuristic scan where lamescan3.exe is spawned as a temporary scanning engine to analyze memory and file integrity.
- Filter/Exclusion: Create an exclusion rule for lamescan3.exe when the parent process is the specific AV service (e.g., TmEngineService.exe, KsGuardSvc.exe) AND the execution path matches the vendor’s installation directory (e.g., C:\Program Files\Kingsoft\Antivirus\).
Automated Patch Management and Compliance Audits
- Scenario: The IT Operations team runs a nightly compliance job using Microsoft SCCM (Configuration Manager) or Ivanti Endpoint Manager. This job deploys a custom Chinese-language asset inventory tool to verify hardware configurations. lamescan3.exe is launched as part of this agent to scan local drives for unauthorized software installations and report back to the central console.
- Filter/Exclusion: Exclude alerts where the process hash matches a known, whitelisted SHA-256 signature stored in the CMDB, specifically when triggered by the ccmexec.exe or IvAgent.exe parent process during the defined maintenance window (e.g., 01:00 – 04:00 UTC).
Regional HR Onboarding and Asset Provisioning Scripts
- **Scenario