PE Armor 046 China Cracking Group

Hunt Hypothesis

This hypothesis targets the presence of executable files matching the YARA signature for the China Cracking Group, indicating potential deployment of specialized malware or tools associated with this threat actor. Proactively hunting for this indicator in Azure Sentinel allows the SOC to identify compromised endpoints or staging areas before the group can establish persistence or execute further post-compromise actions.

YARA Rule

rule PE_Armor_046_China_Cracking_Group: PEiD
{
    strings:
        $a = { E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy Chinese ERP or financial reporting tool (e.g., Yonyou, Kingdee, or specific localized versions of SAP) is updated or installed by the vendor. The vendor’s installer or a specific plugin module may contain obfuscated strings or specific import table structures that match the YARA heuristic for “China Cracking Group” artifacts, particularly if the binary was compiled with specific Chinese SDKs or packed using common Chinese packers (like UPX variants or custom protectors).

  • Filter/Exclusion: Exclude files located in specific vendor directories (e.g., C:\Program Files\Yonyou\, C:\Program Files\Kingdee\) or exclude binaries where the CompanyName metadata field contains known vendor names (“Yonyou”, “Kingdee”, “UFIDA”) and the file size is within a documented range for the specific module.

• Scenario: An internal development team uses a Chinese-origin code obfuscation or packing tool (e.g., a custom build of UPX or a specific Chinese commercial packer like Enigma Protector with Chinese locale settings) to protect proprietary internal utilities or small client-side agents. These tools often leave characteristic section names or string patterns (e.g., specific Chinese character encodings in the resource section) that trigger the YARA rule.

  • Filter/Exclusion: Exclude binaries where the FileDescription or OriginalFilename metadata contains the internal project name or team identifier (e.g., “Internal-Tool-Dev”, “Client-Agent-v2”) and the binary is signed with the internal corporate code-signing certificate.

• Scenario: A scheduled maintenance job runs a Chinese-origin database backup or log rotation utility (e.g., a specific version of DBCC wrapper or a custom script compiled to an executable for performance) that interacts with SQL Server or Oracle. The executable may contain hardcoded Chinese error messages