Chinese Hacktool Set - file Sniffer analyzer SSClone 1210 full version.exe

Hunt Hypothesis

This hunt targets adversaries deploying the specific “Sniffer analyzer SSClone” tool to conduct network traffic analysis and credential sniffing within Azure environments. Proactively hunting for this executable is critical because its presence often indicates early-stage reconnaissance or data exfiltration activities that may evade standard signature-based detections due to its low severity classification.

YARA Rule

rule Sniffer_analyzer_SSClone_1210_full_version {
	meta:
		description = "Chinese Hacktool Set - file Sniffer analyzer SSClone 1210 full version.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "6882125babb60bd0a7b2f1943a40b965b7a03d4e"
	strings:
		$s0 = "http://www.vip80000.com/hot/index.html" fullword ascii
		$s1 = "GetConnectString" fullword ascii
		$s2 = "CnCerT.Safe.SSClone.dll" fullword ascii
		$s3 = "(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 3580KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are specific false positive scenarios for the detection rule “Chinese Hacktool Set - file Sniffer analyzer SSClone 1210 full version.exe”, along with suggested filters and exclusions:

• IT Asset Inventory Scans

  • Scenario: Enterprise IT teams often deploy third-party asset management or vulnerability scanning tools (e.g., SolarWinds NPM, LanDesk, or ManageEngine) that utilize a Chinese-developed network sniffer module to map active devices and analyze traffic protocols. During scheduled weekly inventory scans, the agent may execute SSClone 1210 full version.exe as a background process to capture packet data for reporting.
  • Suggested Filter: Exclude execution of this specific file path when launched by known asset management service accounts (e.g., svc-asset-scan, lan-desk-agent) or from the specific directory where the inventory tool is installed (e.g., C:\Program Files\AssetManager\Tools\).

• Legacy Application Patching and Updates

  • Scenario: Organizations with legacy Chinese-language software suites (common in manufacturing or logistics sectors) may use a bundled update utility named SSClone 1210 full version.exe to patch internal database connectors. This often occurs during off-hours via a scheduled task triggered by the Windows Task Scheduler under the context of the local system account (NT AUTHORITY\SYSTEM).
  • Suggested Filter: Create an exclusion based on the Parent Process Name. If the parent process is svchost.exe (specifically the “TaskScheduler” service) or msiexec.exe, and the file hash matches a known benign version, suppress the alert.

• Third-Party Endpoint Protection Heuristics

  • Scenario: Some endpoint security solutions (such as specific configurations of Trend Micro,