medium
advisory
Creal Stealer: New payload hashes observed
ThreatFox identified six new file samples associated with the Creal Stealer malware family on November 4, 2026.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 5, 13:33 UTC
- Detection
- 4 IOCs
- Source quality
- A1Likely
ThreatFox has reported six new indicators of compromise related to the Creal Stealer malware family (py.creal_stealer). These indicators consist of file hashes for payload samples identified on 2026-11-04. No further details regarding the distribution mechanism or post-compromise behavior were provided in this update.
Recommendation
- Ingest the provided file hashes into your endpoint detection and response (EDR) or file integrity monitoring (FIM) solutions to detect these specific Creal Stealer samples.
- Perform retrospective hunting across historical endpoint logs to identify if any of these identified hashes have been previously executed in the environment.
Immediate actions
Add identified file hashes to endpoint blocking or alert lists
SOC
24h
Threat Hunt
Hunt for execution of newly identified file hashes
medium
high confidence
hunt now
Data: EDR process creation logs (MD5/SHA256 hashes)
Indicators of compromise
2
hash_md5
2
hash_sha256
| Type | Value |
|---|---|
| hash_md5 | 0f1e9ff3fa61acaf74c15bc7178887d6 |
| hash_sha256 | 6fd9ae8104bc4cbd419b5cfbe2a40c4ce63486f8f57585d1071cb3c7d3ddc966 |
| hash_md5 | c927b19e7101727d15b1a28d0c4dc914 |
| hash_sha256 | b99a44bb4bfe7004bdebaec8ecf33a44f3c75650f0f846b90cbefa1199ffe67a |