This hunt detects adversary behavior where malicious actors deploy the Venus Stealer to exfiltrate sensitive credentials and data by matching network traffic against six specific Indicators of Compromise (IOCs). A SOC team should proactively hunt for these IOCs within Azure Sentinel to rapidly identify early-stage infections and prevent potential lateral movement or data breaches before they escalate.
Malware Family: Venus Stealer Total IOCs: 6 IOC Types: sha1_hash, md5_hash, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| md5_hash | 250c4d2f05964b839cb779a2f13826f2 | payload | 2026-08-01 | 95% |
| sha256_hash | f67a176503343855c88d9aac1217277ee4e2badc5e56fe403e56ca30e144b266 | payload | 2026-08-01 | 95% |
| sha1_hash | 8a6a3373a6c7a9b3c202c119ab76b3126464f636 | payload | 2026-08-01 | 95% |
| sha256_hash | fed541de0e768a6132da368ec8e0c66125ed7c144ca7d039bbcfe7b75192ecaa | payload | 2026-08-01 | 95% |
| sha1_hash | 859a5f150f6028fe660051755fb4e7b35d392359 | payload | 2026-08-01 | 95% |
| md5_hash | e27af1a650e95047f7b995cc6929f94e | payload | 2026-08-01 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Venus Stealer
let malicious_hashes = dynamic(["250c4d2f05964b839cb779a2f13826f2", "f67a176503343855c88d9aac1217277ee4e2badc5e56fe403e56ca30e144b266", "8a6a3373a6c7a9b3c202c119ab76b3126464f636", "fed541de0e768a6132da368ec8e0c66125ed7c144ca7d039bbcfe7b75192ecaa", "859a5f150f6028fe660051755fb4e7b35d392359", "e27af1a650e95047f7b995cc6929f94e"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Legitimate Scenario: Security Operations Center (SOC) analysts manually running the ThreatFox platform’s internal synchronization job to update the IOC database. This process often triggers a network scan or file hash check against known good files that match the rule’s signature logic, mimicking the behavior of the Venus Stealer during its initial reconnaissance phase.
svc_threatfox) and limit detection to exclude network traffic on ports 443 or 80 when the source IP belongs to the internal SOC subnet (e.g., 10.50.20.0/24).Legitimate Scenario: An automated nightly backup job executed by Veeam Backup & Replication or Commvault that scans user home directories and shared drives. The stealer’s logic often involves enumerating file systems to identify sensitive data; similarly, the backup agent generates file access events and network connections that align with the Venus Stealer IOCs, particularly when scanning large volumes of documents in C:\Users or \\FileServer\Shares.
\Program Files\Veeam\ or \Commvault\ from the detection logic. Additionally, add a time-based filter to suppress alerts between 01:00 and 05:00 UTC when these scheduled maintenance jobs are active.Legitimate Scenario: Deployment of Microsoft Endpoint Configuration Manager (SCCM) or Intune pushing a new security policy update that requires the client agent to query external repositories for configuration manifests. This activity triggers network connections to specific external domains and file writes in the %ProgramData% directory, which can be misidentified as the stealer’s command