Chinese Hacktool Set - file TracKid.dll

Hunt Hypothesis

This hunt targets adversaries deploying the TracKid.dll component of a Chinese-origin hacktool suite to establish persistent monitoring capabilities within Azure environments. Proactive hunting is essential because this low-severity artifact may indicate early-stage reconnaissance or data exfiltration activities that could be overlooked by standard alert thresholds before escalating into significant incidents.

YARA Rule

rule PLUGIN_TracKid {
	meta:
		description = "Chinese Hacktool Set - file TracKid.dll"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "a114181b334e850d4b33e9be2794f5bb0eb59a09"
	strings:
		$s0 = "E-mail: cracker_prince@163.com" fullword ascii
		$s1 = ".\\TracKid Log\\%s.txt" fullword ascii
		$s2 = "Coded by prince" fullword ascii
		$s3 = "TracKid.dll" fullword ascii
		$s4 = ".\\TracKid Log" fullword ascii
		$s5 = "%08x -- %s" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and 3 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file TracKid.dll detection rule, tailored for a legitimate enterprise environment:

• Scenario: Deployment of Chinese Language Learning Platforms via GPO

  • Context: In multinational enterprises with significant Chinese-speaking staff or operations in China, IT departments often deploy localized versions of software like Microsoft Teams, Zoom, or specialized learning management systems (e.g., Tencent Meeting) using Group Policy Objects (GPO). These applications frequently include TracKid.dll as a legitimate component for input method handling or telemetry.
  • Filter/Exclusion: Create an exclusion rule that ignores the detection if the file path is located within standard application directories (e.g., C:\Program Files\Tencent\Meeting\) AND the parent process is a known deployment agent like Microsoft System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager (ccmexec.exe).

• Scenario: Execution of Localized Antivirus Scans by Chinese Security Vendors

  • Context: Organizations operating in hybrid security environments may run concurrent scans using Chinese-native antivirus solutions such as Kingsoft Internet Security, 360 Total Security, or Qihoo 360. These tools often inject TracKid.dll into the system memory to monitor file integrity and network traffic, triggering the rule during scheduled daily scan cycles.
  • Filter/Exclusion: Exclude alerts where the parent process is a recognized Chinese security executable (e.g., ksafe.exe, 360tray.exe) AND the file hash matches a known “Good” baseline stored in your threat intelligence feed for these specific vendors.

• Scenario: Automated Patching of Office Productivity Suites with Chinese Localization

  • Context: During scheduled maintenance windows, administrators use tools like **WSUS