ThreatFox: CrossRAT IOCs

Hunt Hypothesis

This rule identifies network connections to known CrossRAT command-and-control infrastructure, indicating the presence of a remote access Trojan that grants adversaries persistent control over compromised hosts. Proactively hunting for these IOCs allows the SOC team to detect stealthy RAT deployments before they are leveraged for lateral movement or data exfiltration within the Azure environment.

IOC Summary

Malware Family: CrossRAT Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`4bdf3dc7d3fa0c2776f70b4ca2597930cf956201`	payload	2026-09-04	95%
md5_hash	`54ff1c3f0ae632c2429b9cd907dea567`	payload	2026-09-04	95%
sha256_hash	`a4a65e265ee3974c553aa410b625e4c13108d9e27430f070a6d5d6a9d84a11d2`	payload	2026-09-04	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - CrossRAT
let malicious_hashes = dynamic(["4bdf3dc7d3fa0c2776f70b4ca2597930cf956201", "54ff1c3f0ae632c2429b9cd907dea567", "a4a65e265ee3974c553aa410b625e4c13108d9e27430f070a6d5d6a9d84a11d2"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — CrossRAT

False Positive Guidance

Scenario: Legacy Java Application Deployment
- Context: A development team deploys a legacy Java-based middleware component that uses a custom, obfuscated JAR file for internal communication. The file’s hash or path structure matches a known CrossRAT IOC due to similar naming conventions (e.g., update.jar in a temp directory) or specific API calls.
- Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Apps\LegacyMiddleware\lib\) or filter by parent process java.exe when the file extension is .jar and the path does not contain temp or appdata.
Scenario: Scheduled Maintenance Script Execution
- Context: An IT operations team runs a scheduled PowerShell or Batch job that downloads a configuration patch from an internal repository. The download location is C:\Users\Public\Downloads\ or C:\Temp\, and the file name matches a CrossRAT IOC (e.g., config.bin or patch.exe). The script then executes the file to apply changes.
- Filter/Exclusion: Exclude executions where the parent process is powershell.exe or cmd.exe and the command line contains specific maintenance keywords (e.g., -ExecutionPolicy Bypass or apply_patch), or exclude files in C:\Users\Public\ if the user account is a service account (e.g., svc_itops).
Scenario: Third-Party Agent Installation
- Context: A security or monitoring vendor (e.g., CrowdStrike, SentinelOne) installs or updates its agent. The installer drops a helper executable in a temporary directory with a name that matches a CrossRAT IOC (e.g., helper.exe or agent_update.dll). The file is signed by the vendor but may not be