ThreatFox: Venus Stealer IOCs

Hunt Hypothesis

This detection rule identifies active compromise scenarios where adversaries deploy the Venus Stealer to exfiltrate sensitive credentials and data by matching against a curated set of 24 known indicators of compromise. Proactive hunting for these specific IOCs within Azure Sentinel is critical to rapidly identify early-stage infections, enabling the SOC team to contain potential lateral movement before attackers can fully establish persistence or escalate privileges.

IOC Summary

Malware Family: Venus Stealer Total IOCs: 24 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`e5fb52cb4836455493489879979cf724`	payload	2026-08-15	95%
sha256_hash	`5cc44ec9af3b258dc4cd4fddccfa03550e8f5d3aa57fe78eb9c0805ed0850182`	payload	2026-08-15	95%
sha1_hash	`35ac62eefcad505cd25e97b9aff3c147a608c27e`	payload	2026-08-15	95%
sha1_hash	`93273d32065f099ae72fbf818e70fda2233acbc1`	payload	2026-08-15	95%
md5_hash	`5e973fd7c15c435631fc18e1df82592a`	payload	2026-08-15	95%
sha256_hash	`ad1f1c29707bba2a41e9d964abb63ff0dc764ea98c3e2a1e38a39dd2c7bcfd6b`	payload	2026-08-15	95%
sha256_hash	`514fa7786356f49ad0e1164fec6fcfb3c2759db9c069beac2f89baa804f7d5fe`	payload	2026-08-15	95%
sha1_hash	`c5f1ea4f7fb4e9b3dd5a3257f051110edcd613d0`	payload	2026-08-15	95%
md5_hash	`1d944ff591ebcff069f17e5e57180a6f`	payload	2026-08-15	95%
md5_hash	`17ea6604b441e15f0e96d072aa67efe0`	payload	2026-08-15	95%
md5_hash	`1e1831dac3e7b29ce85e256af3a59bc8`	payload	2026-08-15	95%
sha256_hash	`57478a0f3dcf4df1c96dbb3cd9aa3b255814bd3a4185bf90ba768eb28b471797`	payload	2026-08-15	95%
sha1_hash	`19a544e28b2c0b70efd96ca0a8ec178c275c9bb0`	payload	2026-08-15	95%
sha256_hash	`4f8b3ce56a567f4d1f5a3e4ef0fedcdfad707bfc1b4234397da600f8e2e32316`	payload	2026-08-15	95%
sha1_hash	`bcd816c8d313d033d5bbb36c6ffe89982456e7a4`	payload	2026-08-15	95%
md5_hash	`71a61f1cd6274c59ada288288565632b`	payload	2026-08-15	95%
md5_hash	`61a4fe4b3fd2331c05a5594a12b2c86e`	payload	2026-08-15	95%
sha256_hash	`4b957314a35c2c055475a95ed0cf76b2ea51c2afd9c59ab14be0015d7fbea6be`	payload	2026-08-15	95%
sha1_hash	`d43859ade6f1828829fad88d5be0441893828075`	payload	2026-08-15	95%
sha256_hash	`460001cd92917d1c8d4e538d0ec367abf02e6533e357083a8382a1e41f7be5ce`	payload	2026-08-15	95%
sha1_hash	`4e794424b5aedfbe473ceeca647d98a1056d7564`	payload	2026-08-15	95%
sha1_hash	`652cddd50fc79e027162b7502b7fff935aecf2b5`	payload	2026-08-15	95%
md5_hash	`cfc95149b7433840e6a64ff648a78575`	payload	2026-08-15	95%
sha256_hash	`580529f353d25341fb93ac3f616a58ad37ca8227866d0799e763191528878930`	payload	2026-08-15	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Venus Stealer
let malicious_hashes = dynamic(["e5fb52cb4836455493489879979cf724", "5cc44ec9af3b258dc4cd4fddccfa03550e8f5d3aa57fe78eb9c0805ed0850182", "35ac62eefcad505cd25e97b9aff3c147a608c27e", "93273d32065f099ae72fbf818e70fda2233acbc1", "5e973fd7c15c435631fc18e1df82592a", "ad1f1c29707bba2a41e9d964abb63ff0dc764ea98c3e2a1e38a39dd2c7bcfd6b", "514fa7786356f49ad0e1164fec6fcfb3c2759db9c069beac2f89baa804f7d5fe", "c5f1ea4f7fb4e9b3dd5a3257f051110edcd613d0", "1d944ff591ebcff069f17e5e57180a6f", "17ea6604b441e15f0e96d072aa67efe0", "1e1831dac3e7b29ce85e256af3a59bc8", "57478a0f3dcf4df1c96dbb3cd9aa3b255814bd3a4185bf90ba768eb28b471797", "19a544e28b2c0b70efd96ca0a8ec178c275c9bb0", "4f8b3ce56a567f4d1f5a3e4ef0fedcdfad707bfc1b4234397da600f8e2e32316", "bcd816c8d313d033d5bbb36c6ffe89982456e7a4", "71a61f1cd6274c59ada288288565632b", "61a4fe4b3fd2331c05a5594a12b2c86e", "4b957314a35c2c055475a95ed0cf76b2ea51c2afd9c59ab14be0015d7fbea6be", "d43859ade6f1828829fad88d5be0441893828075", "460001cd92917d1c8d4e538d0ec367abf02e6533e357083a8382a1e41f7be5ce", "4e794424b5aedfbe473ceeca647d98a1056d7564", "652cddd50fc79e027162b7502b7fff935aecf2b5", "cfc95149b7433840e6a64ff648a78575", "580529f353d25341fb93ac3f616a58ad37ca8227866d0799e763191528878930"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Venus Stealer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Venus Stealer IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

Scenario: Scheduled Backup Jobs Executing on Shared Drives
- Context: Enterprise backup solutions (e.g., Veeam, Commvault) often run nightly jobs that enumerate file systems and transfer data to shared network locations. If the backup service account or agent process accesses a specific IOCs path (like C:\Users\Public\Documents or a mapped drive) that matches a Venus Stealer artifact, it triggers an alert.
- Filter/Exclusion: Exclude alerts where the parent process is VeeamAgent.exe, CommServe.exe, or msdtc.exe. Additionally, filter by user context to exclude service accounts (e.g., DOMAIN\BackupSvc) and restrict detection to non-business hours if the backup window is distinct from active user sessions.
Scenario: Endpoint Protection Scanning Cloud Sync Folders
- Context: Antivirus or EDR agents (such as Microsoft Defender for Endpoint, CrowdStrike Falcon, or Carbon Black) frequently scan OneDrive for Business or Google Drive sync folders. Venus Stealer often targets browser profiles and cloud sync directories; if the IOCs include paths like %LocalAppData%\Microsoft\OneDrive, the scanner’s enumeration activity can mimic stealer behavior.
- Filter/Exclusion: Create a rule exclusion based on the parent process name MsMpEng.exe (Defender), FalconSensor.exe (CrowdStrike), or cbengine.exe. Furthermore, exclude file paths containing \OneDrive\ or \Google Drive\ from the detection logic.
Scenario: Admin Deployment of Browser Extensions via GPO
- Context: IT administrators use Group Policy Objects