ThreatFox: Venus Stealer IOCs

Hunt Hypothesis

This hypothesis targets the presence of known Venus Stealer indicators, which are frequently used by threat actors to exfiltrate sensitive data such as browser credentials and cryptocurrency keys from compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify active infections or recent compromises before the stealer can successfully transmit stolen information to attacker-controlled infrastructure.

IOC Summary

Malware Family: Venus Stealer Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`0e0035d9c080a0a78045e8ec10577587`	payload	2026-09-25	95%
sha256_hash	`58620667f662ecf815eb764ef4e1c1d369eb24047154232f9f181cfa0a228b63`	payload	2026-09-25	95%
sha1_hash	`752865298c77004af435fca8b87c063290430cbf`	payload	2026-09-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Venus Stealer
let malicious_hashes = dynamic(["0e0035d9c080a0a78045e8ec10577587", "58620667f662ecf815eb764ef4e1c1d369eb24047154232f9f181cfa0a228b63", "752865298c77004af435fca8b87c063290430cbf"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Venus Stealer

False Positive Guidance

Scenario: A DevOps team deploys a new internal microservice container image that includes a lightweight telemetry agent (e.g., Datadog or New Relic) which writes logs to a path matching one of the Venus Stealer IOCs (e.g., C:\ProgramData\Temp\venus.log or similar generic temp paths).
- Filter/Exclusion: Exclude alerts where the source process is a known container runtime (e.g., containerd.exe, docker.exe) or where the user account is a service account (e.g., DOMAIN\svc-deploy) and the file extension is .log or .json rather than an executable.
Scenario: An IT administrator runs a standard Windows System File Checker (sfc /scannow) or a third-party cleanup tool like CCleaner that temporarily creates files in the %TEMP% or %APPDATA% directories with names that coincidentally match one of the IOCs (e.g., venus.tmp or venus.dat).
- Filter/Exclusion: Exclude events where the parent process is sfc.exe, ccleaner.exe, or tempcleaner.exe, and the file action is “Create” or “Modify” (not “Execute”), specifically if the file is deleted within 5 minutes of creation.
Scenario: A software vendor’s installer (e.g., for Adobe Creative Cloud or Microsoft Office) uses a staging directory named Venus or Venus_Install in the %LOCALAPPDATA% or %PROGRAMFILES% directory during the installation process, triggering a path-based IOC.
- Filter/Exclusion: Exclude alerts where the source process is a known installer executable (e.g., msiexec.exe, setup.exe, install.exe) and the file path contains Venus as a subdirectory