ThreatFox: Creal Stealer IOCs

Hunt Hypothesis

This hunt identifies the presence of known Creal Stealer indicators, a high-severity information stealer that targets sensitive data such as credentials and browser cookies. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect and isolate compromised endpoints before the adversary can exfiltrate data or establish persistence.

IOC Summary

Malware Family: Creal Stealer Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`edae3ddf216afd22d3b9774ed4f3b2b71b9da9810457791723d4982da87260e2`	payload	2026-09-13	95%
sha1_hash	`5e7648ad22e07ef43cdac86178899d26a2b15f4f`	payload	2026-09-13	95%
md5_hash	`610869ca82861f9dd8148f57e607d566`	payload	2026-09-13	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Creal Stealer
let malicious_hashes = dynamic(["edae3ddf216afd22d3b9774ed4f3b2b71b9da9810457791723d4982da87260e2", "5e7648ad22e07ef43cdac86178899d26a2b15f4f", "610869ca82861f9dd8148f57e607d566"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Creal Stealer

False Positive Guidance

Scenario: A DevOps team uses curl or wget to download a specific version of a CI/CD agent (e.g., Jenkins agent, GitLab Runner) or a monitoring agent (e.g., Datadog, New Relic) from a trusted CDN or internal artifact repository that shares the same IP range or domain as the Creal Stealer IOC.
- Filter/Exclusion: Exclude network connections where the source process is a known build/CI tool (e.g., java.exe, node.exe, python.exe running a specific script) and the destination port is 443 (HTTPS), provided the destination IP is in the internal artifact registry CIDR range.
Scenario: An IT administrator performs a manual software deployment or patching task using a script that downloads a binary from a public GitHub release or a vendor’s download server (e.g., https://github.com/.../releases/download/...) which happens to match one of the Creal Stealer IOCs (e.g., a specific SHA256 hash or domain).
- Filter/Exclusion: Exclude events where the source process is a common scripting runtime (powershell.exe, cmd.exe, bash) and the parent process is a known deployment tool (e.g., wsadmin.exe, ansible-playbook, chef-client) or the user account belongs to the IT_Administrators group.
Scenario: A security engineer or malware analyst downloads the Creal Stealer sample or related IOCs for testing in an isolated lab environment or a dedicated “hunting” VM, triggering the rule during the initial download phase.
- Filter/Exclusion: Exclude events originating from hosts tagged with Environment: Lab or Role: Security_Testing, or where the source user account is in the Security_Team group and