ThreatFox: Venus Stealer IOCs

Hunt Hypothesis

This hunt targets the presence of known IOCs associated with the Venus Stealer, a high-severity infostealer that actively exfiltrates sensitive data such as credentials and browser history. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised endpoints before the adversary achieves full data exfiltration or establishes persistence.

IOC Summary

Malware Family: Venus Stealer Total IOCs: 9 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`0960143403b7d6d8bbaed0f1652e83d6376c3cfe1fa6fe63b080b1fab97eb5a6`	payload	2026-09-10	95%
sha1_hash	`5983f394bdc9c2a191b5874a98cb736590ed5734`	payload	2026-09-10	95%
md5_hash	`e728c199f2f1ad356fcbee25a5475c74`	payload	2026-09-10	95%
md5_hash	`f4e051ee49a9559f6d71c7699226e3fb`	payload	2026-09-10	95%
sha256_hash	`a84bef9ffa7f4ee4c682a75f1d0480c8b5cd233e355b885b61ef4a52eaf65dfb`	payload	2026-09-10	95%
sha1_hash	`11397967c121f36edd2e894234627d68394b2e62`	payload	2026-09-10	95%
sha1_hash	`638bb882ff0dba784ecc078c1792706983af0f91`	payload	2026-09-10	95%
md5_hash	`ee12bf94330dbbb5025aae8e1ec908a7`	payload	2026-09-10	95%
sha256_hash	`cbabe6cb9fd822bb69b271c14952397b4d2a571d9e11e08c26312fad1b158163`	payload	2026-09-10	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Venus Stealer
let malicious_hashes = dynamic(["0960143403b7d6d8bbaed0f1652e83d6376c3cfe1fa6fe63b080b1fab97eb5a6", "5983f394bdc9c2a191b5874a98cb736590ed5734", "e728c199f2f1ad356fcbee25a5475c74", "f4e051ee49a9559f6d71c7699226e3fb", "a84bef9ffa7f4ee4c682a75f1d0480c8b5cd233e355b885b61ef4a52eaf65dfb", "11397967c121f36edd2e894234627d68394b2e62", "638bb882ff0dba784ecc078c1792706983af0f91", "ee12bf94330dbbb5025aae8e1ec908a7", "cbabe6cb9fd822bb69b271c14952397b4d2a571d9e11e08c26312fad1b158163"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Venus Stealer

False Positive Guidance

Scenario: A security operations team deploys a YARA rule or Sigma correlation logic to scan for known Venus Stealer hashes (e.g., sha256: 4a2b...) across the endpoint fleet using CrowdStrike Falcon or Microsoft Defender for Endpoint. If the IOCs include generic file paths like C:\Users\Public\Temp\venus.exe or common service names, legitimate administrative scripts that temporarily stage payloads in Public\Temp for testing or deployment (e.g., via PowerShell Copy-Item during a patch cycle) may match the path-based IOC.
- Filter/Exclusion: Exclude alerts where the parent process is a known administrative tool (e.g., powershell.exe, pwsh.exe, msiexec.exe) and the file age is less than 24 hours. Additionally, whitelist the specific directory C:\Users\Public\Temp if it is a designated staging area, but restrict this exclusion to non-production user accounts.
Scenario: The IOC set includes a specific registry key such as HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VenusUpdate or a similar benign-sounding name. During a scheduled Group Policy Object (GPO) refresh or a SCCM (System Center Configuration Manager) deployment, a custom installer script may create a Run key with a name that partially matches the IOC (e.g., VenusAppUpdate) due to a vendor naming convention. This triggers the detection on all machines receiving the update.
- Filter/Exclusion: Correlate the alert with recent SCCM or GPO change logs. If the alert timestamp aligns with a known deployment window (±15 minutes) and the parent process is wuaex.exe or ccmexec.exe, suppress the alert. Alternatively,