← Back to SOC feed Coverage →

Chinese Hacktool Set - file VNCLink.exe

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-17T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt targets adversaries deploying the VNCLink.exe remote access tool to establish persistent command and control channels within Azure Sentinel environments. Proactive investigation is essential because this specific Chinese hacktool may be leveraged for stealthy data exfiltration or lateral movement that standard low-severity alerts might overlook without deeper behavioral analysis.

YARA Rule

rule CN_Tools_VNCLink {
	meta:
		description = "Chinese Hacktool Set - file VNCLink.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "cafb531822cbc0cfebbea864489eebba48081aa1"
	strings:
		$s1 = "C:\\temp\\vncviewer4.log" fullword ascii
		$s2 = "[BL4CK] Patched by redsand || http://blacksecurity.org" fullword ascii
		$s3 = "fake release extendedVkey 0x%x, keysym 0x%x" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 580KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file VNCLink.exe detection rule in an enterprise environment:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/TOOLKIT_Chinese_Hacktools.yar