ThreatFox: KrakenKeylogger IOCs

Hunt Hypothesis

This hypothesis targets the presence of known indicators of compromise associated with the KrakenKeylogger, a high-severity threat that enables adversaries to capture sensitive user credentials and keystrokes. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints or network artifacts before the keylogger can exfiltrate data or establish persistent access.

IOC Summary

Malware Family: KrakenKeylogger Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`b7d29e94613df7d42bd2f882e77a3f85`	payload	2026-09-10	95%
sha256_hash	`cc3417c2cdd3d0a9897528f1229f8649fa7313b348f887aba05173e6542b3e14`	payload	2026-09-10	95%
sha1_hash	`2078271033087b2eb6582ecebf7be4e57099fdaf`	payload	2026-09-10	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - KrakenKeylogger
let malicious_hashes = dynamic(["b7d29e94613df7d42bd2f882e77a3f85", "cc3417c2cdd3d0a9897528f1229f8649fa7313b348f887aba05173e6542b3e14", "2078271033087b2eb6582ecebf7be4e57099fdaf"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — KrakenKeylogger

False Positive Guidance

Scenario: A DevOps engineer uses grep or Select-String to audit application logs for known vulnerability signatures or to verify that a specific string (e.g., a hardcoded API key or version tag) is present in deployed binaries. If the KrakenKeylogger IOCs include common strings or hex patterns, this search command can trigger the detection.
- Filter/Exclusion: Exclude alerts where the process is grep.exe, findstr.exe, or powershell.exe executing Select-String, and the command line contains arguments like -r, -l, or Select-String with a pattern matching the IOC.
Scenario: An IT administrator runs a disk cleanup or deduplication tool (e.g., WinDirStat, TreeSize, or du) that reads file headers or content to calculate sizes or identify duplicates. If the tool opens files containing the IOC strings, it may generate a file read event that matches the hunt package.
- Filter/Exclusion: Exclude alerts where the parent process is a known disk analysis or cleanup utility (e.g., windirstat64.exe, treesize.exe, du.exe) and the action is “Read” or “Open” rather than “Write” or “Create”.
Scenario: A security team performs a YARA rule scan or memory dump analysis using tools like yara64.exe or memdump.exe to hunt for specific malware signatures. The scanning process reads memory or disk sectors containing the IOC patterns, triggering the detection.
- Filter/Exclusion: Exclude alerts where the process name is yara64.exe, yara.exe, or memdump.exe, and the command line includes arguments like -s (scan) or -p (process ID), indicating an active hunting or analysis task.