ThreatFox: Luca Stealer IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying Luca Stealer to silently extract credentials, browser cookies, and cryptocurrency data following successful phishing campaigns or exploit kit infections. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection of this high-severity stealer prevents the initial compromise from escalating into broader identity theft and financial asset exfiltration before lateral movement occurs.

IOC Summary

Malware Family: Luca Stealer Total IOCs: 6 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`7fe8414fe3bc35854a30b5ad87e3f8b5c1fa199f`	payload	2026-07-27	95%
md5_hash	`c037ac52a26a18e7b2e911415e85a080`	payload	2026-07-27	95%
sha256_hash	`8cf7bbe8eb52f88bf5c7129b4923acff510275d5c47a38bf82667c102e6e8c9a`	payload	2026-07-27	95%
sha1_hash	`9d0c78e7d08e01fe65858d1e2c690af0c79cc209`	payload	2026-07-27	95%
md5_hash	`5fae196b68afca48ce650acc79e25126`	payload	2026-07-27	95%
sha256_hash	`56cc93be915c0d59943d0bf3c91dc1956b0af95939b812679197d3607829713f`	payload	2026-07-27	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Luca Stealer
let malicious_hashes = dynamic(["7fe8414fe3bc35854a30b5ad87e3f8b5c1fa199f", "c037ac52a26a18e7b2e911415e85a080", "8cf7bbe8eb52f88bf5c7129b4923acff510275d5c47a38bf82667c102e6e8c9a", "9d0c78e7d08e01fe65858d1e2c690af0c79cc209", "5fae196b68afca48ce650acc79e25126", "56cc93be915c0d59943d0bf3c91dc1956b0af95939b812679197d3607829713f"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Luca Stealer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Luca Stealer IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Legitimate Phishing Simulation Campaigns
- Context: Security teams frequently run internal phishing simulations using tools like KnowBe4 or Proofpoint. These campaigns often distribute emails with attachments (PDFs or Word docs) containing embedded tracking pixels or scripts that mimic the behavior of Luca Stealer’s initial delivery mechanism. If the simulation email contains a specific hash or URL matching the rule’s IOCs, it triggers an alert.
- Filter/Exclusion: Create a filter to exclude traffic originating from internal simulation servers (e.g., *.knowbe4.com or internal IP ranges) and specifically whitelist known simulation attachment hashes used in the current quarter.
Scenario: Scheduled Browser Cookie Backup Jobs
- Context: Luca Stealer targets browser cookies for credential theft. In many enterprises, automated backup scripts (e.g., using PowerShell or Veeam) are scheduled to run nightly via Windows Task Scheduler. These jobs export user profile data and cookie stores to a central repository. The file I/O patterns and network exfiltration of these backups can closely resemble the data-stealing behavior of Luca Stealer.
- Filter/Exclusion: Exclude alerts generated by specific service accounts (e.g., svc-backup-agent) running on known backup servers during their defined maintenance windows (e.g., 02:00–04:00 UTC). Additionally, filter out network flows where the destination is a known internal file share or cloud storage bucket used for backups.
Scenario: Enterprise Endpoint Detection and Response (EDR) Scans
- Context: EDR solutions like CrowdStrike Falcon, **Microsoft Defender