ThreatFox: Creal Stealer IOCs

Hunt Hypothesis

This hunt targets the presence of Creal Stealer IOCs to identify potential credential theft or data exfiltration attempts by this malware family. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect compromised endpoints early, mitigating the risk of persistent access and lateral movement within the environment.

IOC Summary

Malware Family: Creal Stealer Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`65752cdf1c2e5463a694cffd51a20732`	payload	2026-09-04	95%
sha256_hash	`352f292ab6580214f325b4200606fb868bf5b7cfdd3b8599733389cb15a0ea1d`	payload	2026-09-04	95%
sha1_hash	`e0e8c6c04ecef485b9586f930df6b666de325a54`	payload	2026-09-04	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Creal Stealer
let malicious_hashes = dynamic(["65752cdf1c2e5463a694cffd51a20732", "352f292ab6580214f325b4200606fb868bf5b7cfdd3b8599733389cb15a0ea1d", "e0e8c6c04ecef485b9586f930df6b666de325a54"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Creal Stealer

False Positive Guidance

Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a microservice that includes a dependency on a specific version of libcurl or a shared library whose hash matches one of the Creal Stealer IOCs due to a known benign build artifact.
- Filter/Exclusion: Exclude alerts where the process path resides within standard CI/CD agent directories (e.g., C:\Jenkins\workspace\, /var/lib/jenkins/) or where the parent process is a recognized build tool (e.g., java.exe, node.exe, python.exe).
Scenario: An IT administrator performs a manual software inventory audit using a tool like CCleaner or BulkCrunch that temporarily loads or scans a file matching an IOC hash during a deep disk cleanup or deduplication task.
- Filter/Exclusion: Exclude alerts if the parent process is a known inventory or cleanup utility (e.g., ccleaner64.exe, bulkcrunch.exe) and the file location is within the user’s temporary directory (%TEMP%) or a designated audit staging folder.
Scenario: A security team runs a YARA rule scan or memory dump analysis using tools like Volatility or Yara64 against a known test image or captured sample that intentionally contains the Creal Stealer IOCs for validation purposes.
- Filter/Exclusion: Exclude alerts if the process name matches common forensic/scanning tools (e.g., yara64.exe, volatility3.exe, rclone.exe) or if the file path contains keywords like test, sample, quarantine, or forensics.
Scenario: A developer clones a legacy open-source repository that includes a vendored third-party library with a