Chinese Hacktool Set - file WebCrack4-RouterPasswordCracking.exe

Hunt Hypothesis

This hunt targets adversaries deploying the specific Chinese hacktool WebCrack4-RouterPasswordCracking.exe to conduct credential brute-forcing attacks against network infrastructure. Proactively searching for this executable in Azure Sentinel is critical because its low-severity classification may cause it to be overlooked, allowing attackers to establish persistence and exfiltrate data before triggering higher-level alerts.

YARA Rule

rule WebCrack4_RouterPasswordCracking {
	meta:
		description = "Chinese Hacktool Set - file WebCrack4-RouterPasswordCracking.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "00c68d1b1aa655dfd5bb693c13cdda9dbd34c638"
	strings:
		$s0 = "http://www.site.com/test.dll?user=%USERNAME&pass=%PASSWORD" fullword ascii
		$s1 = "Username: \"%s\", Password: \"%s\", Remarks: \"%s\"" fullword ascii
		$s14 = "user:\"%s\" pass: \"%s\" result=\"%s\"" fullword ascii
		$s16 = "Mozilla/4.0 (compatible; MSIE 4.01; Windows NT)" fullword ascii
		$s20 = "List count out of bounds (%d)+Operation not allowed on sorted string list%String" wide
	condition:
		uint16(0) == 0x5a4d and filesize < 5000KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the WebCrack4-RouterPasswordCracking.exe detection rule in an enterprise environment, along with suggested filters or exclusions:

• IT Asset Management Scans (e.g., Lansweeper or SCCM)

  • Scenario: Enterprise asset discovery tools often download and execute portable diagnostic utilities to audit network devices. A scheduled job might deploy WebCrack4-RouterPasswordCracking.exe to a specific endpoint to verify router credentials before the tool is automatically deleted after execution.
  • Filter/Exclusion: Whitelist the file path if it resides in a dedicated “AssetDiscovery” or “TempTools” directory (e.g., C:\ProgramData\Lansweeper\Tools\) and exclude executions where the parent process is the asset management agent (e.g., LanSweep.exe or ccmexec.exe).

• Network Security Audits via PowerShell Scripts

  • Scenario: A security team runs a weekly PowerShell script (Invoke-NetworkAudit.ps1) that dynamically downloads password cracking utilities to test the strength of default router passwords across remote branches. The script invokes the executable directly from a temporary download folder before archiving results.
  • Filter/Exclusion: Create an exclusion for executions where the parent process is powershell.exe or pwsh.exe, specifically when the command line arguments include the specific hash of WebCrack4-RouterPasswordCracking.exe and the execution path matches a known script directory (e.g., C:\Scripts\NetworkAudit\).

• Vendor-Supported Remote Maintenance Sessions

  • Scenario: During scheduled maintenance windows, third-party network vendors connect via RDP to perform firmware upgrades. They may launch this specific Chinese utility from their portable USB drive or a mapped network share (\\FileServer\Vendors\Tools\)