← Back to SOC feed Coverage →

Chinese Hacktool Set - file report.dll

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-15T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies the presence of report.dll, a known component of the Chinese Hacktool set often associated with supply chain compromises or initial reconnaissance activities by state-sponsored actors. Proactively hunting for this artifact in Azure Sentinel is critical to validate its legitimacy against baseline configurations and uncover potential lateral movement vectors before they escalate into significant data exfiltration events.

YARA Rule

rule dat_report {
	meta:
		description = "Chinese Hacktool Set - file report.dll"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "4582a7c1d499bb96dad8e9b227e9d5de9becdfc2"
	strings:
		$s1 = "<a href=\"http://www.xfocus.net\">X-Scan</a>" fullword ascii
		$s2 = "REPORT-ANALYSIS-OF-HOST" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 480KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 2 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file report.dll detection rule, along with suggested filters or exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/TOOLKIT_Chinese_Hacktools.yar