ThreatFox: Creal Stealer IOCs

Hunt Hypothesis

This detection rule identifies adversaries leveraging Creal Stealer to exfiltrate critical assets like credentials and browser cookies following successful phishing campaigns. Proactively hunting for these indicators in Azure Sentinel is essential to rapidly contain data breaches targeting financial and personal information before sensitive details are compromised.

IOC Summary

Malware Family: Creal Stealer Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`b296953446d3161e61e3982c8c66d68f1295f788`	payload	2026-07-25	95%
md5_hash	`3c9852c53cb45221886b34ed6bc7d674`	payload	2026-07-25	95%
sha256_hash	`f273dfb134166251f00456f8fcff32a827afa03781794f8071281dcadc37b444`	payload	2026-07-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Creal Stealer
let malicious_hashes = dynamic(["b296953446d3161e61e3982c8c66d68f1295f788", "3c9852c53cb45221886b34ed6bc7d674", "f273dfb134166251f00456f8fcff32a827afa03781794f8071281dcadc37b444"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Creal Stealer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Creal Stealer IOCs rule, tailored to an enterprise environment with suggested filters and exclusions:

Scenario: Automated Browser Cookie Synchronization by Admin Tools
- Context: Enterprise deployment tools like Microsoft Intune, Jamf, or Group Policy (GPO) often push browser extensions or scripts that synchronize user cookies and login tokens across devices. These processes access local browser profile directories (AppData\Local\Google, Mozilla Firefox) to back up or migrate data, mimicking the file access behavior of Creal Stealer.
- Filter/Exclusion: Create an exclusion rule for the specific Service Accounts (e.g., DOMAIN\AdminSyncSvc) and restrict the detection scope to exclude processes running under these accounts when accessing known browser profile paths. Additionally, whitelist the specific hash or path of the synchronization tool (e.g., C:\Program Files\Microsoft Intune Agent\IntuneAgent.exe).
Scenario: Scheduled Credential Backup Jobs via PowerShell
- Context: IT Operations teams frequently run scheduled PowerShell scripts (via Task Scheduler) during off-hours to archive user credentials and session tokens for compliance auditing. These scripts enumerate browser data folders and extract JSON/SQLite database files containing cookies, which triggers the IOCs associated with Creal’s data exfiltration logic.
- Filter/Exclusion: Implement a time-based exclusion window (e.g., 02:00 – 05:00 local time) for detections originating from the Task Scheduler service (SchTasks.exe) or specific PowerShell process trees (powershell.exe spawned by svchost.exe). Alternatively, exclude file access events where the parent process is identified as a known internal backup utility.
**Scenario: Endpoint DLP Agent Scanning Browser Artifacts