ThreatFox: Creal Stealer IOCs

Hunt Hypothesis

This detection identifies active threats from the Creal Stealer malware by monitoring for specific indicators of compromise that signal credential theft and data exfiltration attempts. Proactively hunting for these IOCs within Azure Sentinel is critical to rapidly isolate compromised endpoints before adversaries can escalate privileges or move laterally across the network.

IOC Summary

Malware Family: Creal Stealer Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`4479eaf6ed86a3fc385f60c6e6521e5e341e6d99`	payload	2026-08-07	95%
md5_hash	`6108296a2c9c763a4b56e3cb611ab096`	payload	2026-08-07	95%
sha256_hash	`ba7ef674b42b85717ae947a9cab116e0256f4996e949a8fdad8c5404aeef7a20`	payload	2026-08-07	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Creal Stealer
let malicious_hashes = dynamic(["4479eaf6ed86a3fc385f60c6e6521e5e341e6d99", "6108296a2c9c763a4b56e3cb611ab096", "ba7ef674b42b85717ae947a9cab116e0256f4996e949a8fdad8c5404aeef7a20"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Creal Stealer

False Positive Guidance

Here are the documented false positive scenarios and corresponding exclusion strategies for the ThreatFox: Creal Stealer IOCs detection rule:

Scenario: Legitimate Software Deployment via SCCM/Intune
- Context: The IT Operations team deploys a new version of an enterprise browser or security agent (e.g., Microsoft Edge, Chrome EDR) using Microsoft Endpoint Configuration Manager (SCCM). The deployment package includes a specific hash or certificate that matches one of the Creal Stealer IOCs due to shared code signing vendors.
- Suggested Filter/Exclusion: Create an exclusion rule based on the ProcessName and CommandLine. Exclude alerts where the process is ccmsetup.exe (SCCM) or msiexec.exe running under the SYSTEM account, specifically when the command line contains the deployment package GUID associated with known internal software updates.
Scenario: Scheduled Backup Jobs Executing on File Servers
- Context: A nightly scheduled task (Task Scheduler) runs a backup utility (e.g., Veeam Agent or Acronis Cyber Protect) that scans and archives user profile directories. The backup agent generates network traffic or file access patterns involving specific DLLs that overlap with the Creal Stealer’s IOCs, triggering the hunt package.
- Suggested Filter/Exclusion: Implement a time-based exclusion window (e.g., 01:00–05:00 local time) for hosts identified as “File Server” or “Backup Agent.” Additionally, exclude alerts where the parent process is vssvc.exe (Volume Shadow Copy Service) or specific backup service executables like veeamagent.exe.
Scenario: Admin Maintenance via Remote PowerShell Sessions
- Context: A System Administrator performs a remote maintenance task using PowerShell.exe to query registry keys