ThreatFox: Venus Stealer IOCs

Hunt Hypothesis

This hypothesis targets the presence of known indicators of compromise associated with the Venus Stealer, a malware family designed to exfiltrate sensitive data such as credentials and browser history. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints before the adversary can establish persistence or extract data, thereby reducing the dwell time of this high-severity threat.

IOC Summary

Malware Family: Venus Stealer Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`19c1644e3bb7a4dce5b90077d03c806327015bad`	payload	2026-09-04	95%
md5_hash	`7c7fd63c3ca386594d5099865d1ff7c0`	payload	2026-09-04	95%
sha256_hash	`d09fdae7f6e7b170094ea36a602d6c2f830933c368b43fa49dadce5c3f3fd0c4`	payload	2026-09-04	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Venus Stealer
let malicious_hashes = dynamic(["19c1644e3bb7a4dce5b90077d03c806327015bad", "7c7fd63c3ca386594d5099865d1ff7c0", "d09fdae7f6e7b170094ea36a602d6c2f830933c368b43fa49dadce5c3f3fd0c4"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Venus Stealer

False Positive Guidance

Scenario: A DevOps team deploys a custom PowerShell script to automate the cleanup of temporary files and application logs on web servers, which coincidentally matches the file path or hash of one of the Venus Stealer IOCs (e.g., C:\Users\Public\Documents\update.exe).
- Filter/Exclusion: Exclude processes where the parent process is powershell.exe or pwsh.exe and the command line contains specific automation keywords like -ExecutionPolicy Bypass or -File C:\Scripts\cleanup.ps1.
Scenario: An IT administrator runs a scheduled task using Task Scheduler to execute a third-party utility for disk defragmentation or registry cleanup, which uses a generic executable name (e.g., cleaner.exe) that overlaps with a known Venus Stealer binary name.
- Filter/Exclusion: Exclude executions where the parent process is svchost.exe (specifically the Task Scheduler service) or taskschd.msi, and the working directory is within standard admin tool directories like C:\Program Files\AdminTools\ or C:\Scripts\.
Scenario: A security engineer performs a manual threat hunt or incident response by copying a sample of a known benign tool (e.g., Sysinternals suite) to a temporary folder for analysis, triggering the IOC match due to the file location or hash.
- Filter/Exclusion: Exclude events where the user account belongs to a specific security group (e.g., SecurityEngineers or IRTeam) and the file path contains C:\Temp\ or C:\Users\<User>\AppData\Local\Temp\.
Scenario: A legacy application installer or updater (e.g., for Adobe Creative Cloud or Java) drops a helper executable with a generic name (e.g., helper.exe