ThreatFox: CrossRAT IOCs

Hunt Hypothesis

This hunt targets the presence of CrossRAT indicators of compromise, a remote access trojan frequently used by adversaries to establish persistent control and exfiltrate data from compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel is critical to identify early-stage intrusions and prevent the malware from leveraging its remote access capabilities to pivot laterally or execute further malicious actions within the environment.

IOC Summary

Malware Family: CrossRAT Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`9a0bf53c0238db10d5072e1eed3e899476a93f08`	payload	2026-09-12	95%
md5_hash	`778536300231f9b2986156aca82877a2`	payload	2026-09-12	95%
sha256_hash	`0fb478ddeb84afbe562320708adf25611b302d4e89bc0557d070dd6e89dec6a3`	payload	2026-09-12	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - CrossRAT
let malicious_hashes = dynamic(["9a0bf53c0238db10d5072e1eed3e899476a93f08", "778536300231f9b2986156aca82877a2", "0fb478ddeb84afbe562320708adf25611b302d4e89bc0557d070dd6e89dec6a3"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — CrossRAT

False Positive Guidance

Scenario: A DevOps team deploys a custom Java-based monitoring agent that uses the same default port (e.g., 4000) and user-agent string as CrossRAT for internal health checks.
- Filter/Exclusion: Exclude processes where the executable path is under C:\Program Files\InternalMonitoring\ or where the parent process is java.exe and the command line contains --health-check.
Scenario: An IT administrator runs a legacy backup utility that creates a temporary directory named crossrat_tmp in the user’s %TEMP% folder during a scheduled nightly backup job.
- Filter/Exclusion: Exclude file creation events where the parent process is wbadmin.exe or vssadmin.exe and the file path matches *%TEMP%\crossrat_tmp\*.
Scenario: A security engineer performs a manual threat hunt using a YARA rule that scans for CrossRAT strings, causing the YARA scanner process to briefly open the IOC-related files or ports for validation.
- Filter/Exclusion: Exclude network connections or file accesses where the source process is yara.exe or yara64.exe and the command line includes --scan or specific rule names like crossrat_hunt.yar.
Scenario: A developer tests a new internal API client that mimics CrossRAT’s HTTP header structure for compatibility testing against a staging server, using the same User-Agent string.
- Filter/Exclusion: Exclude HTTP requests where the source IP is within the internal development subnet (e.g., 10.20.0.0/24) and the User-Agent matches CrossRAT/1.0 but the destination port is 8080 (staging) instead of the typical CrossRAT port