Chinese Hacktool Set - file v.exe

Hunt Hypothesis

This detection targets adversaries deploying the “v.exe” component of a Chinese hacktool suite to establish persistence and conduct reconnaissance within Azure environments. Proactive hunting for this specific artifact is critical because its low severity rating may cause it to be overlooked in standard alerting workflows, allowing attackers to maintain a stealthy foothold before escalating their operations.

YARA Rule

rule Ms_Viru_v {
	meta:
		description = "Chinese Hacktool Set - file v.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "ecf4ba6d1344f2f3114d52859addee8b0770ed0d"
	strings:
		$s1 = "c:\\windows\\system32\\command.com /c " fullword ascii
		$s2 = "Easy Usage Version -- Edited By: [email protected]" fullword ascii
		$s3 = "OH,Sry.Too long command." fullword ascii
		$s4 = "Success! Commander." fullword ascii
		$s5 = "Hey,how can racle work without ur command ?" fullword ascii
		$s6 = "The exploit thread was unable to map the virtual 8086 address space" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and 3 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file v.exe detection rule, including suggested filters and exclusions:

• Scenario: Legitimate Deployment of “Veeam Backup & Replication” Agents

  • Context: In many enterprise environments, Veeam installs a background service named v.exe (or similar variants like vbr.exe depending on version) as part of the backup agent installation. This is often triggered during scheduled maintenance windows or new workstation provisioning.
  • Filter/Exclusion: Create an exclusion for processes with the image path starting with C:\Program Files\Veeam\Backup and Replication\Agent\ AND the file publisher signed by “Veeam Software.” Additionally, exclude execution events where the parent process is msiexec.exe or setup.exe, indicating a legitimate installation phase.

• Scenario: Execution of “Visual Studio” Build Tools

  • Context: Development teams frequently utilize Microsoft Visual Studio Build Tools or standalone compilers that spawn v.exe (often associated with the Visual C++ Redistributable installer or specific build automation scripts). This is common in CI/CD pipelines running on build servers.
  • Filter/Exclusion: Filter for file hashes matching known Microsoft-signed versions of v.exe. Exclude events where the command line arguments contain flags such as /quiet, /norestart, or paths pointing to C:\Program Files (x86)\Microsoft Visual Studio\ and C:\Windows\Microsoft.NET\Framework\v4.0.30319\.

• Scenario: Scheduled Task for “Veritas NetBackup” Operations

  • Context: Organizations using Veritas NetBackup often run scheduled maintenance jobs that invoke a utility named v.exe to manage client communication or perform local cache cleanup. These tasks typically run