ThreatFox: Venus Stealer IOCs

Hunt Hypothesis

This hunt detects adversary activity consistent with the Venus Stealer malware by identifying matches against a curated set of 30 specific Indicators of Compromise (IOCs). Proactively hunting for these signals in Azure Sentinel is critical to rapidly identify and contain potential data exfiltration incidents before they escalate into broader credential theft or ransomware attacks.

IOC Summary

Malware Family: Venus Stealer Total IOCs: 30 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`0054d2622e335797a8697982af417982`	payload	2026-08-25	95%
md5_hash	`34c53b495cd8216306cd4dff6986077c`	payload	2026-08-25	95%
sha256_hash	`86f27425624e99fca1a6735b4ed5e192f575794e57f16c47a1e068bb1e608d6a`	payload	2026-08-25	95%
sha1_hash	`863adf6289db25fdc4ac0ef2e1a2ae63d43366b9`	payload	2026-08-25	95%
sha1_hash	`37e1c520d9d6359582f566e2c8339d6a2a66e546`	payload	2026-08-25	95%
sha256_hash	`0beaf7839d3a1b2e0c86566fd597c159da9f154e2be236d482ecb2c9ff32e225`	payload	2026-08-25	95%
sha256_hash	`d1db4e527ecf5ebb601744ec216724d6d25a0c2468668acc4e121cadfaa59a52`	payload	2026-08-25	95%
sha1_hash	`88a8ad0a1d77f3f8b2f0a5fa267e8916206a5bcb`	payload	2026-08-25	95%
md5_hash	`817d31c309449bb678cfa47b1f5feba5`	payload	2026-08-25	95%
sha256_hash	`8f9a5a5bda7dc3faf1d5cb74f0b4dc63643ab3bb205f119e585c5f290adc9137`	payload	2026-08-25	95%
sha1_hash	`0c7481ffcf1ceee98e3500c552cec40c6d7d8fbe`	payload	2026-08-25	95%
md5_hash	`0cd74763c8271e198bd5d3bcc2a3bb1e`	payload	2026-08-25	95%
sha1_hash	`8a57b2a9cbad582ca6211f7ee7686e6450782853`	payload	2026-08-25	95%
md5_hash	`c1a774ce1a8b5aa8ccf6b7c4b1cfd0ee`	payload	2026-08-25	95%
sha256_hash	`fba00f02ac5abe5b9f7185d74ba753aa12984517fd79ce70a17ffd0ab3fa9adb`	payload	2026-08-25	95%
sha1_hash	`c2d4370aecc06016e4aaa606c635b1c9d219972e`	payload	2026-08-25	95%
md5_hash	`e0859d1fc8816b37a16f4eb2a7232eb8`	payload	2026-08-25	95%
sha256_hash	`4c16f5ebd5c633b7a793ffa2cd96daddc5a503d82ed4fbe636109d89164ec02b`	payload	2026-08-25	95%
sha1_hash	`7f6e450810b169a163ff5eff32af8a7f760b819b`	payload	2026-08-25	95%
md5_hash	`2e2059a2dd7fea88e1fcd3bd0f43c237`	payload	2026-08-25	95%
md5_hash	`2d477f318e8178d7c281af39c95fc674`	payload	2026-08-25	95%
sha256_hash	`78cc6707797ef77a94e80e6b30eef0fad0fbefd1f8a0bd16a41dc085182f29d2`	payload	2026-08-25	95%
md5_hash	`04f90fc30a53adb8bdd435966daaaba2`	payload	2026-08-25	95%
sha256_hash	`689c485bde77370d62a36c7c86d1675e439b393ba0e6d7d5102d5009ea7e5dbe`	payload	2026-08-25	95%
sha1_hash	`d04d94ff0607ea6b2ef9009c4e4bbe1b50513c50`	payload	2026-08-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Venus Stealer
let malicious_hashes = dynamic(["0054d2622e335797a8697982af417982", "34c53b495cd8216306cd4dff6986077c", "86f27425624e99fca1a6735b4ed5e192f575794e57f16c47a1e068bb1e608d6a", "863adf6289db25fdc4ac0ef2e1a2ae63d43366b9", "37e1c520d9d6359582f566e2c8339d6a2a66e546", "0beaf7839d3a1b2e0c86566fd597c159da9f154e2be236d482ecb2c9ff32e225", "d1db4e527ecf5ebb601744ec216724d6d25a0c2468668acc4e121cadfaa59a52", "88a8ad0a1d77f3f8b2f0a5fa267e8916206a5bcb", "817d31c309449bb678cfa47b1f5feba5", "8f9a5a5bda7dc3faf1d5cb74f0b4dc63643ab3bb205f119e585c5f290adc9137", "0c7481ffcf1ceee98e3500c552cec40c6d7d8fbe", "0cd74763c8271e198bd5d3bcc2a3bb1e", "8a57b2a9cbad582ca6211f7ee7686e6450782853", "c1a774ce1a8b5aa8ccf6b7c4b1cfd0ee", "fba00f02ac5abe5b9f7185d74ba753aa12984517fd79ce70a17ffd0ab3fa9adb", "c2d4370aecc06016e4aaa606c635b1c9d219972e", "e0859d1fc8816b37a16f4eb2a7232eb8", "4c16f5ebd5c633b7a793ffa2cd96daddc5a503d82ed4fbe636109d89164ec02b", "7f6e450810b169a163ff5eff32af8a7f760b819b", "2e2059a2dd7fea88e1fcd3bd0f43c237", "2d477f318e8178d7c281af39c95fc674", "78cc6707797ef77a94e80e6b30eef0fad0fbefd1f8a0bd16a41dc085182f29d2", "04f90fc30a53adb8bdd435966daaaba2", "689c485bde77370d62a36c7c86d1675e439b393ba0e6d7d5102d5009ea7e5dbe", "d04d94ff0607ea6b2ef9009c4e4bbe1b50513c50", "b285d9d8aead39204623c4e85421e0e4b00b7e7a6bd39a443fb94a7caa5c55b1", "18c098823aae8ddcd4cd5d1839611368357cbc61", "525c10abc92d3a9946ee83297c6a86757fcceaaf", "a1c41938d1695d48bcdad002ec1f36cc", "3daf2a4af9b0b1e3be06922ebba16b17"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Venus Stealer

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Venus Stealer IOCs detection rule, along with targeted exclusion strategies:

Scenario: Automated Security Scans by EDR Agents
- Context: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne frequently perform background telemetry collection. Their agents often generate network traffic to update threat intelligence feeds or scan local file hashes against known IOCs, which can mimic the specific process execution patterns of Venus Stealer.
- Filter/Exclusion: Create a rule exclusion based on the Process Name and File Path. Exclude processes matching C:\Program Files\CrowdStrike\fsqagent.exe, C:\Windows\System32\MsMpEng.exe, or C:\Program Files\SentinelOne\Agent\SSDS.exe when they initiate outbound connections to known security vendor IP ranges (e.g., CrowdStrike Cloud, Microsoft Update servers).
Scenario: Scheduled Backup and Archiving Jobs
- Context: Enterprise backup solutions such as Veeam Backup & Replication, Rubrik, or Commvault often run scheduled jobs during off-hours. These agents compress and transfer large datasets to cloud repositories, generating high-volume file I/O and network traffic that aligns with the IOCs associated with data exfiltration behaviors in Venus Stealer.
- Filter/Exclusion: Implement a time-based exclusion window (e.g., 02:00–06:00 local time) for specific service accounts. Additionally, exclude file paths containing backup signatures like C:\Program Files\Veeam\Backup and Replication or C:\Rubrik\Agent, specifically when the user context is a dedicated service account (e.g., DOMAIN\svc_backup)