Chinese Hacktool Set - file mysql_pwd_crack.exe

Hunt Hypothesis

This hunt targets the deployment of the mysql_pwd_crack.exe utility by adversaries associated with Chinese threat groups to identify and exploit weak MySQL credentials within the environment. Proactively hunting for this specific artifact in Azure Sentinel is critical because its presence often signals an early-stage reconnaissance or lateral movement phase, allowing the SOC team to validate legitimate usage versus potential credential harvesting before broader compromise occurs.

YARA Rule

rule mysql_pwd_crack {
	meta:
		description = "Chinese Hacktool Set - file mysql_pwd_crack.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "57d1cb4d404688804a8c3755b464a6e6248d1c73"
	strings:
		$s1 = "mysql_pwd_crack 127.0.0.1 -x 3306 -p root -d userdict.txt" fullword ascii
		$s2 = "Successfully --> username %s password %s " fullword ascii
		$s3 = "[email protected] http://zhouzhen.eviloctal.org" fullword ascii
		$s4 = "-a automode  automatic crack the mysql password " fullword ascii
		$s5 = "mysql_pwd_crack 127.0.0.1 -x 3306 -a" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and 1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - mysql_pwd_crack.exe detection rule, tailored for an enterprise environment:

• Database Administration & Migration Scripts

  • Scenario: Database administrators frequently use internal migration scripts or third-party tools (e.g., Oracle GoldenGate, AWS DMS, or custom PowerShell wrappers) that bundle a generic mysql_pwd_crack.exe utility to validate connection strings and reset service account passwords during nightly maintenance windows. The tool is often placed in the C:\Program Files\InternalDBTools\ directory rather than the standard system path, triggering the file-based detection logic.
  • Suggested Filter: Exclude execution from known administrative service accounts (e.g., DOMAIN\DBAdminService) and restrict the rule to trigger only if the file hash is not present in the enterprise allow-list or if the parent process is a recognized scheduler like TaskScheduler.exe.

• Automated Backup Verification Jobs

  • Scenario: Enterprise backup solutions such as Veeam Backup & Replication or Commvault often include embedded utilities to verify database integrity and test credential validity before initiating large-scale backups. These jobs may spawn a temporary instance of mysql_pwd_crack.exe within the backup agent’s working directory (e.g., C:\Program Files\Veeam\BackupAgent\) to ensure the MySQL service account credentials are active, mimicking the behavior of a standalone password cracking tool.
  • Suggested Filter: Create an exclusion based on the parent process name (vbragent.exe or simserver.exe) and the specific file path pattern containing “Veeam” or “Commvault,” ensuring that only unexpected executions outside these known parent contexts generate alerts.

• Third-Party Compliance & Auditing Agents

  • Scenario: Security compliance platforms like **Qualys