Chinese Hacktool Set - file rejoice.exe

Hunt Hypothesis

This detection identifies the presence of rejoice.exe, a component associated with the Chinese Hacktool set, which adversaries may deploy to establish persistence or conduct reconnaissance within an Azure environment. Proactively hunting for this file is critical because its low-severity classification often allows it to evade standard alerting thresholds, enabling threat actors to operate undetected while gathering intelligence on cloud resources.

YARA Rule

rule Pc_rejoice {
	meta:
		description = "Chinese Hacktool Set - file rejoice.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "fe634a9f5d48d5c64c8f8bfd59ac7d8965d8f372"
	strings:
		$s1 = "@members.3322.net/dyndns/update?system=dyndns&hostname=" fullword ascii
		$s2 = "http://www.xxx.com/xxx.exe" fullword ascii
		$s3 = "@ddns.oray.com/ph/update?hostname=" fullword ascii
		$s4 = "No data to read.$Can not bind in port range (%d - %d)" fullword wide
		$s5 = "ListViewProcessListColumnClick!" fullword ascii
		$s6 = "http://iframe.ip138.com/ic.asp" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 3000KB and 3 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file rejoice.exe detection rule, including suggested filters and exclusions:

• Scenario: Legitimate Deployment of “Rejoice” CRM/ERP Modules

  • Context: Many Chinese enterprise resource planning (ERP) or Customer Relationship Management (CRM) suites utilize a module named rejoice.exe for local data synchronization, report generation, or license validation. This is often installed by the IT department on user workstations during standard software updates.
  • Suggested Filter/Exclusion: Create an exception based on the File Path and Digital Signature. Exclude alerts where rejoice.exe resides in a known application directory (e.g., C:\Program Files\Rejoice Solutions\ or C:\Apps\ERP_Client\) AND is signed by a recognized vendor certificate (e.g., “Rejoice Software Inc.” or the specific Chinese vendor’s root CA).

• Scenario: Scheduled Maintenance Job for Localized Backup Utilities

  • Context: A scheduled Task Scheduler job runs nightly to execute rejoice.exe as part of a localized backup utility that compresses and encrypts regional user data before uploading it to an internal file server. This is common in environments with heavy Chinese language support requirements where standard tools are replaced by specialized local ones.
  • Suggested Filter/Exclusion: Implement a filter based on the Parent Process and Execution Time. Exclude events where rejoice.exe is spawned by TaskScheduler.exe (or svchost.exe) specifically during maintenance windows (e.g., 02:00 – 04:00 UTC) and verify the command line arguments contain expected backup flags (e.g., -mode=sync -target=internal).

• **Scenario: Execution by System Administrators