This hunt targets the presence of Creal Stealer indicators, a macOS-based information stealer that exfiltrates sensitive data such as browser credentials and cryptocurrency wallet files. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, preventing the silent extraction of high-value assets before the malware can establish persistence or communicate with its C2 infrastructure.
Malware Family: Creal Stealer Total IOCs: 3 IOC Types: md5_hash, sha1_hash, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha1_hash | c6d42910d3b464dba6ae2a22ae377908e2d23431 | payload | 2026-09-07 | 95% |
| md5_hash | 86957fe59d5a2d92b8e20909be744b71 | payload | 2026-09-07 | 95% |
| sha256_hash | 04ce455ab1ce258073d3261e137201cdabd87444011fe4a487c4e92d80594e22 | payload | 2026-09-07 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Creal Stealer
let malicious_hashes = dynamic(["c6d42910d3b464dba6ae2a22ae377908e2d23431", "86957fe59d5a2d92b8e20909be744b71", "04ce455ab1ce258073d3261e137201cdabd87444011fe4a487c4e92d80594e22"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A DevOps team uses a CI/CD pipeline (e.g., Jenkins or GitLab CI) to deploy a custom internal build of a Java-based application that shares a specific SHA-256 hash or file path with a known Creal Stealer component due to similar naming conventions (e.g., update.jar or config.dll).
C:\Jenkins\workspace\, /var/lib/jenkins/workspace/) or exclude processes spawned by java.exe or node.exe when the file path matches the IOC but the parent process is a recognized build tool.Scenario: An IT administrator manually copies a legacy utility or driver package (e.g., setup.exe or driver_installer.msi) from a shared network drive to a local temp folder (%TEMP% or C:\Users\%USERNAME%\AppData\Local\Temp) to troubleshoot a hardware issue, and the file’s metadata or hash coincidentally matches one of the Creal Stealer IOCs.
%TEMP% or AppData\Local\Temp if the parent process is explorer.exe or cmd.exe and the file age is less than 1 hour, or exclude specific known-good hashes from the shared library that have been verified by the asset management system.Scenario: A scheduled task runs a Python script (e.g., backup_script.py) that generates a temporary log file or data dump with a filename identical to a Creal Stealer IOC (e.g., data.bin or output.txt) in a user’s home directory or a project-specific folder.
.py, .log, or `.