ThreatFox: Venus Stealer IOCs

Hunt Hypothesis

This hunt detects adversary behavior where attackers deploy the Venus Stealer malware to exfiltrate sensitive credentials and data by matching network traffic against six specific Indicators of Compromise (IOCs). Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of this stealer prevents lateral movement and data loss before the threat can establish persistence or escalate privileges within the environment.

IOC Summary

Malware Family: Venus Stealer Total IOCs: 6 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`61151b8e4db0fc9cc48a2c0a701955b13bbeca22`	payload	2026-08-14	95%
md5_hash	`51debef8194480827f1317a93fc93ca3`	payload	2026-08-14	95%
sha1_hash	`63debe2bc11935cd1f2e7ff5429c640620f0d380`	payload	2026-08-14	95%
md5_hash	`e5fe8fdb73df57602871e4cedeb3803a`	payload	2026-08-14	95%
sha256_hash	`540b4dfb2bceb2f68f26d7173f07d195f3ed5a83942fefcb92ffb583c74ffc32`	payload	2026-08-14	95%
sha256_hash	`191dccb04b3a98cf557a8bd994c6b8df433782653a3fa445bfa86ad5e6a5928a`	payload	2026-08-14	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Venus Stealer
let malicious_hashes = dynamic(["61151b8e4db0fc9cc48a2c0a701955b13bbeca22", "51debef8194480827f1317a93fc93ca3", "63debe2bc11935cd1f2e7ff5429c640620f0d380", "e5fe8fdb73df57602871e4cedeb3803a", "540b4dfb2bceb2f68f26d7173f07d195f3ed5a83942fefcb92ffb583c74ffc32", "191dccb04b3a98cf557a8bd994c6b8df433782653a3fa445bfa86ad5e6a5928a"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Venus Stealer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Venus Stealer IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

Scenario: Scheduled Security Tool Updates via PowerShell
- Context: Enterprise endpoints often run scheduled PowerShell jobs (e.g., using Invoke-RestMethod or curl) to fetch update manifests from internal repositories. If the Venus Stealer IOCs include specific hash values or network destinations used by tools like WSUS, Intune Management Extension, or CrowdStrike Falcon, legitimate update traffic may trigger the rule.
- Suggested Filter/Exclusion: Exclude processes where ProcessName is PowerShell.exe, msiexec.exe, or CcmExec.exe (System Center Configuration Manager) AND the parent process is a known system service (e.g., Task Scheduler). Additionally, filter out network connections to internal IP ranges (e.g., 10.x.x.x) that are whitelisted as trusted update servers.
Scenario: Legitimate Cloud Backup and Agent Communication
- Context: Managed backup solutions like Veeam, Rubrik, or Acronis Cyber Protect frequently utilize specific executable paths and network ports to communicate with their cloud gateways. If the Venus Stealer IOCs overlap with the digital signatures or certificate thumbprints of these backup agents, routine data synchronization will generate alerts.
- Suggested Filter/Exclusion: Create an exclusion based on ProcessPath containing known backup agent directories (e.g., C:\Program Files\Veeam\..., C:\ProgramData\Rubrik\...). Furthermore, exclude events where the FileHash matches a pre-approved list of known good hashes for these specific vendor executables.
**Scenario: Admin-Driven Script Execution via SCCM