Chinese Hacktool Set - file mysqlfast.exe

Hunt Hypothesis

This detection identifies the presence of mysqlfast.exe, a known artifact from the Chinese Hacktool set often deployed by advanced persistent threat groups to establish persistence or conduct reconnaissance within Windows environments. Proactively hunting for this file in Azure Sentinel is critical because its low severity classification may cause it to be overlooked during routine monitoring, allowing adversaries to maintain a covert foothold before escalating their activities.

YARA Rule

rule mysqlfast {
	meta:
		description = "Chinese Hacktool Set - file mysqlfast.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "32b60350390fe7024af7b4b8fbf50f13306c546f"
	strings:
		$s2 = "Invalid password hash: %s" fullword ascii
		$s3 = "-= MySql Hash Cracker =- " fullword ascii
		$s4 = "Usage: %s hash" fullword ascii
		$s5 = "Hash: %08lx%08lx" fullword ascii
		$s6 = "Found pass: " fullword ascii
		$s7 = "Pass not found" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 900KB and 4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - mysqlfast.exe detection rule, tailored for a legitimate enterprise environment:

• Database Migration and Backup Operations via DBeaver or Navicat Enterprise

  • Scenario: Database administrators frequently use cross-platform tools like DBeaver Community/Enterprise or Navicat Premium to connect to MySQL instances. These applications often bundle their own optimized MySQL client libraries (sometimes named mysqlfast.exe internally) to handle high-speed data transfer and query execution during scheduled nightly ETL jobs or manual schema migrations.
  • Suggested Filter: Create an exclusion based on the parent process name (dbeaver.exe, navicat.exe) and restrict the file path to the application’s installation directory (e.g., C:\Program Files\DBeaver\plugins\mysqlfast.exe).

• Automated Patch Management by SCCM or Intune

  • Scenario: During Windows Update cycles, System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager (Intune) may deploy a custom maintenance package for the organization’s internal MySQL-based inventory system. The deployment script extracts mysqlfast.exe to a temporary working directory (e.g., %TEMP%\Updates\MySQLPatch) to verify database integrity before applying security patches, triggering the rule upon file creation and execution.
  • Suggested Filter: Exclude executions where the parent process is ccmexec.exe or MicrosoftEdgeUpdate.exe and the file path contains known update staging folders (e.g., \Windows\CCMCache\, \Temp\).

• Legacy Financial Reporting Tool Execution

  • Scenario: A specialized financial reporting application, such as a custom wrapper around SAP BusinessObjects or an internal legacy tool like Crystal Reports, utilizes mysqlfast.exe to fetch real-time transaction data from the