ThreatFox: Venus Stealer IOCs

Hunt Hypothesis

This hypothesis targets the presence of Venus Stealer indicators, which signal an adversary actively harvesting credentials, browser sessions, and cryptocurrency assets for exfiltration. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints before the threat actor can leverage stolen secrets to pivot laterally or execute financial theft.

IOC Summary

Malware Family: Venus Stealer Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`19c1644e3bb7a4dce5b90077d03c806327015bad`	payload	2026-09-04	95%
md5_hash	`7c7fd63c3ca386594d5099865d1ff7c0`	payload	2026-09-04	95%
sha256_hash	`d09fdae7f6e7b170094ea36a602d6c2f830933c368b43fa49dadce5c3f3fd0c4`	payload	2026-09-04	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Venus Stealer
let malicious_hashes = dynamic(["19c1644e3bb7a4dce5b90077d03c806327015bad", "7c7fd63c3ca386594d5099865d1ff7c0", "d09fdae7f6e7b170094ea36a602d6c2f830933c368b43fa49dadce5c3f3fd0c4"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Venus Stealer

False Positive Guidance

Browser Extension Installation via Group Policy or MDM
- Scenario: An IT administrator deploys a corporate security or productivity browser extension (e.g., LastPass, 1Password, or a custom internal SSO helper) to all endpoints via Group Policy (GPO) or Mobile Device Management (MDM) tools like Intune or SCCM. The installation process may write specific registry keys or drop configuration files that match the IOCs for known Venus Stealer browser hooks or credential storage paths.
- Filter/Exclusion: Exclude events where the parent process is a known deployment agent (e.g., gpupdate.exe, IntuneManagementExtension.exe, or SCCMClient.exe) and the file path resides in standard enterprise software directories (e.g., C:\Program Files\ or C:\Program Files (x86)\) rather than user-specific temp or appdata folders.
Legitimate Crypto Wallet Synchronization
- Scenario: Finance or treasury teams use enterprise-grade cryptocurrency wallet software (e.g., Ledger Live, Trezor Suite, or MetaMask on a dedicated kiosk) to sync balances or export transaction histories. The malware’s IOCs often target common wallet data directories (e.g., AppData\Roaming\MetaMask or AppData\Local\Trezor). A scheduled backup job or a user-initiated export operation may trigger file creation or registry access alerts that mimic the stealer’s data exfiltration behavior.
- Filter/Exclusion: Allow file system access or registry writes to known wallet directories if the parent process is the official wallet application executable (e.g., LedgerLive.exe, TrezorSuite.exe) and the user belongs to a specific finance or treasury security group.
Credential Manager or Password Vault Updates
- Scenario: Enterprise password managers (e