ThreatFox: Venus Stealer IOCs

Hunt Hypothesis

This detection rule identifies the presence of the Venus Stealer malware, which actively harvests credentials and exfiltrates sensitive data from compromised endpoints within the Azure Sentinel environment. Proactively hunting for these specific IOCs is critical to enable rapid containment before adversaries can leverage stolen identities to escalate privileges or move laterally across the network.

IOC Summary

Malware Family: Venus Stealer Total IOCs: 9 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`53b2409da145971e26878378ddd1338be7ba48d0`	payload	2026-08-02	95%
md5_hash	`de65b65e7d5d3fd35f062341b5d47eff`	payload	2026-08-02	95%
sha256_hash	`c703f7c8a9719198f450e6e9f91df340f810a197ef44a24926212c18d70abc8a`	payload	2026-08-02	95%
sha1_hash	`46c192138f740f6cce76d27b560b3b7c5ea1125e`	payload	2026-08-02	95%
md5_hash	`50a9a1fcb001dc2e806fce909475a18c`	payload	2026-08-02	95%
sha256_hash	`8fe83c4ceebaf00bfa977ff415dc067c962f7159c75431a0849d4342e505573c`	payload	2026-08-02	95%
sha256_hash	`077480d961420c8b53b68059ce2493a1318756c7f9b93e2242020740f98afe20`	payload	2026-08-02	95%
sha1_hash	`52ccf3e4ef9c5bf212ad9a083d0df892d1fcd91a`	payload	2026-08-02	95%
md5_hash	`368f60b8e34fb19caa134fcd7d2079d0`	payload	2026-08-02	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Venus Stealer
let malicious_hashes = dynamic(["53b2409da145971e26878378ddd1338be7ba48d0", "de65b65e7d5d3fd35f062341b5d47eff", "c703f7c8a9719198f450e6e9f91df340f810a197ef44a24926212c18d70abc8a", "46c192138f740f6cce76d27b560b3b7c5ea1125e", "50a9a1fcb001dc2e806fce909475a18c", "8fe83c4ceebaf00bfa977ff415dc067c962f7159c75431a0849d4342e505573c", "077480d961420c8b53b68059ce2493a1318756c7f9b93e2242020740f98afe20", "52ccf3e4ef9c5bf212ad9a083d0df892d1fcd91a", "368f60b8e34fb19caa134fcd7d2079d0"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Venus Stealer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Venus Stealer IOCs rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Legitimate Cloud Backup Agent Exfiltration
- Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often exfiltrate large amounts of credential data (user lists, AD snapshots) to cloud storage endpoints. If the backup agent’s process name or network destination overlaps with Venus Stealer IOCs, it triggers a false alert during scheduled nightly jobs.
- Filter/Exclusion: Create an exclusion based on the specific Process Name (e.g., vbrservice.exe or rubrik-agent) and restrict the trigger to exclude traffic destined for known cloud backup IP ranges or FQDNs (e.g., *.veeam.com, *.rubrik.com).
Scenario: Automated HR Onboarding Scripts
- Context: IT Operations teams frequently use scheduled PowerShell scripts or tools like Microsoft Endpoint Configuration Manager (SCCM) to onboard new hires. These tasks often involve reading local credential stores and pushing data to central HR databases, mimicking the “credential stealing” behavior of Venus Stealer.
- Filter/Exclusion: Implement a filter excluding alerts generated by processes running under the SYSTEM or specific Service Accounts (e.g., DOMAIN\HR-Onboarding-Svc) during defined maintenance windows (e.g., 02:00–04:00 AM).
Scenario: Endpoint Detection and Response (EDR) Telemetry Uploads
- Context: EDR agents such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint periodically upload telemetry data, including hashed credentials and process trees, to their cloud