ThreatFox: QvoidStealer IOCs

Hunt Hypothesis

This hunt targets adversary behavior where QvoidStealer malware establishes initial footholds by leveraging specific known indicators of compromise to exfiltrate sensitive data from endpoints. Proactively hunting for these IOCs within Azure Sentinel is critical because early detection enables rapid containment before the stealer can propagate laterally or escalate privileges across the cloud environment.

IOC Summary

Malware Family: QvoidStealer Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`50cf5b4eb0b43d08455a381b05f4a4d3`	payload	2026-07-13	95%
sha256_hash	`34ad97945a1f70cdbf8af7777a6c71c990d841840cf3c94a387f6cc83450ad4b`	payload	2026-07-13	95%
sha1_hash	`63000ff3aa0958801d3549446c7853f0d0223bcf`	payload	2026-07-13	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - QvoidStealer
let malicious_hashes = dynamic(["50cf5b4eb0b43d08455a381b05f4a4d3", "34ad97945a1f70cdbf8af7777a6c71c990d841840cf3c94a387f6cc83450ad4b", "63000ff3aa0958801d3549446c7853f0d0223bcf"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — QvoidStealer

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: QvoidStealer IOCs detection rule, tailored for an enterprise environment where legitimate activities may mimic the behavior of this stealer malware:

Endpoint Protection Policy Updates via Admin Console
- Scenario: The central security management server (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) pushes a scheduled policy update that includes new threat intelligence signatures. This process involves downloading and validating specific hash values that overlap with the QvoidStealer IOCs to ensure coverage, triggering the detection logic during the nightly maintenance window.
- Filter/Exclusion: Create an exclusion rule based on the Source Host (e.g., Security-Management-Srv01) or filter out events where the Process Name is the known security agent service (e.g., CSPService.exe or MsMpEng.exe) running under a system account, provided the action is “Policy Update” or “Signature Download.”
Enterprise Software Deployment via SCCM/Intune
- Scenario: The IT Operations team executes a scheduled deployment of a critical application patch (e.g., Adobe Acrobat Reader or Zoom) using Microsoft Endpoint Configuration Manager (SCCM). The installation package contains a pre-installer script that downloads and verifies specific DLLs or executables which share hash fingerprints with the QvoidStealer IOCs, causing a match during the “Application Installation” phase.
- Filter/Exclusion: Exclude events where the Parent Process is ccmexec.exe (SCCM) or IntuneManagementExtension.exe, and the File Path resides within the standard deployment directories (e.g., C:\Windows\CCMCache\ or C:\Program Files\Microsoft Intune Management Extension\).
Automated Compliance Scanning by Internal Audit Tools *