ThreatFox: DarkMegi IOCs

Hunt Hypothesis

This hunt detects adversary behavior consistent with the DarkMegi campaign by identifying network and host activity matching its specific set of 75 known Indicators of Compromise (IOCs). A SOC team should proactively hunt for these signals in Azure Sentinel to rapidly identify early-stage infections or lateral movement attempts that may have evaded standard signature-based detection.

IOC Summary

Malware Family: DarkMegi Total IOCs: 75 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`3f16cbcabc497bfaa636dfaa15838b40a365f7b0`	payload	2026-08-01	95%
md5_hash	`54f01dad36b831af726d6d9596453269`	payload	2026-08-01	95%
sha1_hash	`910cd3d2ff7c6f295a3d419185f323a38e3f7ee7`	payload	2026-08-01	95%
md5_hash	`7fccc3d18c8769d5e3753c7752e627dd`	payload	2026-08-01	95%
sha256_hash	`a337142611fcc576de5e9f66c3ea6c6560ad4546b65fc26128da391704cf398d`	payload	2026-08-01	95%
sha1_hash	`8a01a324c7a55196838a928ffd5d7bd9f92d554a`	payload	2026-08-01	95%
md5_hash	`1ca8aa7ac6bc5055075fb2cdd8a26a85`	payload	2026-08-01	95%
sha256_hash	`9af4be59ed11580fb6bd030154f3754bca7ed4cac423f2757d4bcbb00ac731ce`	payload	2026-08-01	95%
sha1_hash	`60f74fc2fdb38bc880c3e6a401f63ee113d81191`	payload	2026-08-01	95%
md5_hash	`5f891920ceaf109bfe6ada7a2cbb1ade`	payload	2026-08-01	95%
sha256_hash	`1385e8516443797d38586cb48d813895944a42fac9fd11354fc68d7704008823`	payload	2026-08-01	95%
md5_hash	`bda2bb5184d1b60afa45573792061aad`	payload	2026-08-01	95%
sha256_hash	`4d812e300f9ce078bfc2a339214d924adb3b8cacb926df370bd3d4bfe758a16a`	payload	2026-08-01	95%
sha256_hash	`cb6e6f1ac01fea84d0eb0a3d62c25cab4f1ef74713a4960aaa7eef2d30c4d95b`	payload	2026-08-01	95%
sha1_hash	`69c44874dbec16119132289df0b39f2e78700cbb`	payload	2026-08-01	95%
sha256_hash	`f36ac03885daffa0f5a794f26d781d4538f1f7bfee4cc65c53b6f47717e1ec70`	payload	2026-08-01	95%
sha1_hash	`3e970e1e6c6d1beb0e9d0354d43dc1f08252c083`	payload	2026-08-01	95%
md5_hash	`b72568cbac516ee69d07c0549eb2ea70`	payload	2026-08-01	95%
sha256_hash	`495609c54d92864f5acaacf9a7b3afb93651eda94011924124e3d9f5fee87f0e`	payload	2026-08-01	95%
sha1_hash	`bf7ad130ab61adb1972a7ec2282673f8a1d71bda`	payload	2026-08-01	95%
md5_hash	`4490c254ec2b2703db8a16bf6d606372`	payload	2026-08-01	95%
sha256_hash	`34a1064b1713dde3b975e118f3504345fb427e69ebbd8687310535cc13238c18`	payload	2026-08-01	95%
sha1_hash	`1e964c3e084b6441e98c9159c476dac15b9b673a`	payload	2026-08-01	95%
md5_hash	`980e772a9a94439b7a520aa212ccde1b`	payload	2026-08-01	95%
sha256_hash	`1d5ae223f76a832f843906c0bb65f57912738f4bd3d75c4e7dc08780009928eb`	payload	2026-08-01	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - DarkMegi
let malicious_hashes = dynamic(["3f16cbcabc497bfaa636dfaa15838b40a365f7b0", "54f01dad36b831af726d6d9596453269", "910cd3d2ff7c6f295a3d419185f323a38e3f7ee7", "7fccc3d18c8769d5e3753c7752e627dd", "a337142611fcc576de5e9f66c3ea6c6560ad4546b65fc26128da391704cf398d", "8a01a324c7a55196838a928ffd5d7bd9f92d554a", "1ca8aa7ac6bc5055075fb2cdd8a26a85", "9af4be59ed11580fb6bd030154f3754bca7ed4cac423f2757d4bcbb00ac731ce", "60f74fc2fdb38bc880c3e6a401f63ee113d81191", "5f891920ceaf109bfe6ada7a2cbb1ade", "1385e8516443797d38586cb48d813895944a42fac9fd11354fc68d7704008823", "bda2bb5184d1b60afa45573792061aad", "4d812e300f9ce078bfc2a339214d924adb3b8cacb926df370bd3d4bfe758a16a", "cb6e6f1ac01fea84d0eb0a3d62c25cab4f1ef74713a4960aaa7eef2d30c4d95b", "69c44874dbec16119132289df0b39f2e78700cbb", "f36ac03885daffa0f5a794f26d781d4538f1f7bfee4cc65c53b6f47717e1ec70", "3e970e1e6c6d1beb0e9d0354d43dc1f08252c083", "b72568cbac516ee69d07c0549eb2ea70", "495609c54d92864f5acaacf9a7b3afb93651eda94011924124e3d9f5fee87f0e", "bf7ad130ab61adb1972a7ec2282673f8a1d71bda", "4490c254ec2b2703db8a16bf6d606372", "34a1064b1713dde3b975e118f3504345fb427e69ebbd8687310535cc13238c18", "1e964c3e084b6441e98c9159c476dac15b9b673a", "980e772a9a94439b7a520aa212ccde1b", "1d5ae223f76a832f843906c0bb65f57912738f4bd3d75c4e7dc08780009928eb", "d3b1396064288d4de0a75e3610686eec5bec1c7d", "6149707e85bb4acf2e0e5c86690dd17b", "24ff4db86fde0788e9741b50b84fa5a3", "ad3988ef3e08a174e1be32d96ebc5ad5", "78522cef155cb91d0d141e669e1d86496b2f99bd12ca1aa8cb5e71feb2f6a85e", "5b31d940e53cdf93939409d5ffe22ce166d20380", "499c922bab4e4a90f7aeea989003cacbfbf8e0a5adf3445fcd9218a233a28308", "515af72fdf631f461dcb54643f59d59ad6358178", "379fa7dc5e9d0c24ccc447b94e6411073a3b632167f2f829e11cd9de9be6143c", "870832c60eed7d0a30698bf3b5348935bfabf8fb", "2a7048073bccaf0147ad5e319d8b46de", "17601dca3e65a91e23ca9e18f810b36a49af7105", "78c3a904fc779747e60f9bc7a2731b51", "e9e3cc4ce44a3612fee3af73c875c6fc8b070113", "f797302610ad737448e4af1f83e83275", "8671ab1812189739dcb89810b3c31485229490d7ee7da8a13947739f272d82b1", "21e58ac1f6519f884aa4518ebd8fefaacbbe1f2c", "6409a0cb4467e308b67d5d55e8b0883e", "f4ee40d8468758eac0fabdafd5c26d2bdfb38fe13ea6d023a98cf74b1e8ff06d", "cb2a2557af090e6bcd0a423b443122dd4b45adf2", "9df61f1a2019a33e3b47ce2e258913f6", "7290ffa77eabbde606bfc3590af9f8dc78809ec19c9ea436304f3134b6e4fc4e", "523017a8c3835990c16fba5d4521d526", "1ac0570ceb2f538a1f124e2d80b9bb279a13a71a134ff4759355762a4abe5e26", "59761bd256f7f015ebb6563899da74a132ab7286a5b5e5a8f61cafcece9fab8c"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — DarkMegi

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: DarkMegi IOCs detection rule, including tailored filters and exclusions:

Legitimate Cloud Backup Agent Scans
- Scenario: Enterprise backup solutions (e.g., Veeam, Commvault, or Rubrik) often perform scheduled integrity checks that hash large volumes of data. If the DarkMegi IOCs include specific file hashes or network destinations used by these vendors’ update servers, the rule may trigger during nightly backup windows.
- Filter/Exclusion: Exclude processes running under the VeeamTransport.exe, CommServe.exe, or rubrik-agent service accounts from the detection logic. Additionally, add a time-based filter to suppress alerts between 01:00 and 05:00 UTC for these specific process names.
Internal Security Tool Communication
- Scenario: The organization’s Endpoint Detection and Response (EDR) platform (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) communicates with its management console to fetch policy updates or threat intelligence feeds. If DarkMegi IOCs overlap with the IP ranges or domain names of these EDR cloud endpoints, legitimate telemetry traffic will generate alerts.
- Filter/Exclusion: Create an exclusion rule for network connections originating from the FalconSensor.exe or MsMpEng.exe processes connecting to known internal security subnets (e.g., 10.20.x.x). Whitelist specific IOCs that match the EDR vendor’s public IP ranges in the ThreatFox feed.
Scheduled Software Deployment Jobs
- Scenario: IT Operations teams utilize tools like SCCM (Microsoft Endpoint Configuration Manager) or Ansible to push software updates and patches during maintenance windows. These jobs often download manifests or binaries from central repositories that may share DNS names or IP addresses with