Chinese Hacktool Set - file pc2015.exe

Hunt Hypothesis

This hunt targets adversaries deploying the specific Chinese hacktool pc2015.exe to establish persistent footholds or conduct reconnaissance within Azure Sentinel environments. Proactively hunting for this file is critical because its presence often indicates early-stage intrusion by threat actors utilizing region-specific tooling that may bypass standard signature-based detections due to its low severity classification.

YARA Rule

rule Pc_pc2015 {
	meta:
		description = "Chinese Hacktool Set - file pc2015.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "de4f098611ac9eece91b079050b2d0b23afe0bcb"
	strings:
		$s0 = "\\svchost.exe" fullword ascii
		$s1 = "LON\\OD\\O-\\O)\\O%\\O!\\O=\\O9\\O5\\O1\\O" fullword ascii
		$s8 = "%s%08x.001" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 309KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file pc2015.exe detection rule, tailored for a legitimate enterprise environment:

• Legitimate Deployment of PC2015 Accounting Software

  • Scenario: The organization utilizes “PC2015” (a specific version of a Chinese financial/accounting suite) as their primary ERP or bookkeeping tool. During the initial installation or major patch cycle, the installer extracts pc2015.exe to %ProgramFiles%\PC2015\Bin\. This is a standard business application file that shares the exact name with the known hacktool signature but serves a legitimate financial function rather than a remote access tool.
  • Suggested Filter: Create an exclusion based on the full file path and publisher. Exclude alerts where File.Path matches C:\Program Files\PC2015\Bin\pc2015.exe AND Image.Publisher is “Shanghai PC Software Co., Ltd.” (or the specific vendor name associated with your ERP).

• Scheduled Monthly Financial Reconciliation Job

  • Scenario: A scheduled Windows Task runs every month on the first business day to execute a financial reconciliation script. This task launches pc2015.exe as a background process to aggregate data from local SQL databases and generate PDF reports for the finance department. The execution occurs automatically without user interaction, often triggering file creation or network connection events that mimic hacktool behavior.
  • Suggested Filter: Implement a logic exclusion based on the parent process and scheduled task name. Exclude alerts where Parent.Image is C:\Windows\System32\svchost.exe (or TaskScheduler) AND the Process.CommandLine contains arguments specific to the reconciliation job, such as -mode=batch -report=monthly.

• **IT