Chinese Hacktool Set - file Radmin_Hash.exe

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying the Radmin remote administration tool as a persistent command and control mechanism within Azure environments to facilitate lateral movement or data exfiltration. Proactively hunting for this specific artifact is critical because its legitimate appearance often masks malicious activity, requiring analysts to distinguish between authorized administrative usage and unauthorized persistence by threat actors operating in Chinese-centric threat landscapes.

YARA Rule

rule Radmin_Hash {
	meta:
		description = "Chinese Hacktool Set - file Radmin_Hash.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "be407bd5bf5bcd51d38d1308e17a1731cd52f66b"
	strings:
		$s1 = "<description>IEBars</description>" fullword ascii
		$s2 = "PECompact2" fullword ascii
		$s3 = "Radmin, Remote Administrator" fullword wide
		$s4 = "Radmin 3.0 Hash " fullword wide
		$s5 = "HASH1.0" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 600KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific scenarios where the Chinese Hacktool Set - file Radmin_Hash.exe rule may trigger false positives in an enterprise environment, along with suggested filters or exclusions:

• Remote Administration Deployment via Group Policy

  • Scenario: The IT Operations team deploys the legacy remote management tool “RAdmin Server” to a specific subset of Windows 10/11 workstations using Active Directory Group Policy Preferences (GPP). During the scheduled deployment window, the installer extracts Radmin_Hash.exe into the %ProgramFiles%\RAdmin\Bin directory to perform integrity checks on existing agent configurations.
  • Filter/Exclusion: Exclude file paths matching C:\Program Files\RAdmin\Bin\Radmin_Hash.exe and restrict the alert scope to exclude processes spawned by gpupdate.exe or gpprefclt.exe.

• Automated Patch Management Scans

  • Scenario: The organization utilizes Ivanti Patch (or similar tools like SCCM/MECM) which includes a custom maintenance script for Chinese-language asset inventory. This script periodically invokes Radmin_Hash.exe to verify the digital signatures of critical system binaries before applying security patches, specifically targeting servers running localized versions of Windows Server 2019/2022.
  • Filter/Exclusion: Create a whitelist rule for the parent process IvantiPatchAgent.exe (or ccmexec.exe) executing files within the C:\ProgramData\Ivanti\Patch\Tools\ directory, specifically filtering out events where the file hash matches the known benign baseline of the RAdmin utility.

• Third-Party Backup Integrity Verification

  • Scenario: A scheduled nightly job using Veeam Backup & Replication runs a pre-backup verification task on virtual machines hosting Chinese