s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-2013324 high

📛 Threat Title

Raven Stealer: SHA256 hash of a malware sample (payload) 8cd439c7280a220a58cafe479982556ebe8581e53d953684f48a748e2b4b91bc

Category: Raven Stealer Published: Source updated: First seen: Last updated: Source: Threatfox IOCs/Threats

Description

Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Raven Stealer. Confidence: 95. First seen: 2026-11-03 16:42:44 UTC. Reporter: Grim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 8cd439c7280a220a58cafe479982556ebe8581e53d953684f48a748e2b4b91bc VT 45 / 75

IOC database

Type
hash_sha256
Value
8cd439c7280a220a58cafe479982556ebe8581e53d953684f48a748e2b4b91bc
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
WARDENStealer

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 45 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Infostealer/Win.Lzveil.R797565
Alibaba malicious Trojan:Win64/ShellcodeRunner.8a559d94
alibabacloud malicious Trojan:Win/ShellcodeRunner.CRY
ALYac malicious Gen:Variant.Yogi.85599
Antiy-AVL malicious Trojan/Win32.DLLhijack
APEX malicious Malicious
Arcabit malicious Trojan.Yogi.D14E5F
Avast malicious Win64:MalwareX-gen [Misc]
AVG malicious Win64:MalwareX-gen [Misc]
Avira malicious TR/W64.Agent
BitDefender malicious Gen:Variant.Yogi.85599
Bkav malicious W32.Malware.DDDBF2C1
CrowdStrike malicious win/malicious_confidence_90% (D)
CTX malicious dll.unknown.yogi
Cylance malicious Unsafe
Cynet malicious Malicious (score: 100)
Elastic malicious malicious (high confidence)
Emsisoft malicious Gen:Variant.Yogi.85599 (B)
ESET-NOD32 malicious Win64/ShellcodeRunner.CQR trojan
F-Secure malicious Trojan.TR/W64.Agent
GData malicious Gen:Variant.Yogi.85599
Google malicious Detected
Gridinsoft malicious Trojan.Win64.Wacatac.sa
huorong malicious Trojan/W64.ShellLoader.ea!crit
Ikarus malicious Win32.Outbreak
K7AntiVirus malicious Trojan ( 006d9bf01 )
K7GW malicious Trojan ( 006d9bf01 )
Kaspersky malicious Trojan.Win32.Agent.xyegsb
Kingsoft malicious Win32.Trojan.Agent.a
Lionic malicious Trojan.Win32.ShellcodeRunner.4!c
McAfeeD malicious ti!8CD439C7280A
Microsoft malicious Trojan:Win32/Wacatac.B!ml
MicroWorld-eScan malicious Gen:Variant.Yogi.85599
Paloalto malicious generic.ml
Panda malicious Trj/PhxBzA.A
Rising malicious Malware.Undefined!8.C (TFE:6:C9WtrIs9t1G)
Sangfor malicious Trojan.Win32.Save.a
SentinelOne malicious Static AI - Suspicious PE
Sophos malicious Mal/Generic-S
Symantec malicious Trojan.Gen.MBT
Tencent malicious Win64.Trojan.Shellcoderunner.Vdkl
TrellixENS malicious Artemis!90422F53FAFC
TrendMicro-HouseCall malicious TROJ_GEN.R002H09K226
Varist malicious W64/ABTrojan.DOIY-3470
VIPRE malicious Gen:Variant.Yogi.85599

Details From VirusTotal

Basic Properties
MD590422f53fafcfb51cf5a748334d99c3a
SHA-195ca2eac1d346c24d5c9569c041c65ce2b0261d9
SHA-2568cd439c7280a220a58cafe479982556ebe8581e53d953684f48a748e2b4b91bc
VHash175066656d655d155az4enzbeze
SSDEEP12288:3x9vBlAUlpWqi9oqNP2AHc6FzdlY1EMEN333cAKU9qkwiDcbINY7kA:3x9vXRqlTHcKzf7RN3376ylNY7
TLSHT146F40254FA8D82FDD025C23986535A15F67238054B61AAFB83D09B3B2F367D0873DBA1
File typeWin32 DLL
File type tagpedll
File extensiondll
MagicPE32+ executable (DLL) (GUI) x86-64, for MS Windows
File size708.5 KB
History
Creation date2026-11-02 17:34 UTC
First seen on VirusTotal2026-11-02 17:45 UTC
Last submission2026-11-02 17:48 UTC
Last analysis2026-11-03 21:09 UTC
Last modified on VirusTotal2026-11-03 23:10 UTC
Known Names
  • 8cd439c7280a220a58cafe479982556ebe8581e53d953684f48a748e2b4b91bc.exe
  • j0djyzna.exe
  • jli.dll

References (2)

  • Malpedia profile Threatfox IOCs/Threats
  • ThreatFox IOC page Threatfox IOCs/Threats

    Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Raven Stealer. Confidence: 95. First seen: 2026-11-03 16:42:44 UTC. Reporter: Grim.

Remediations (10)

  • MalwareBazaar | RavenStealer
    web:bazaar.abuse.ch

    A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as RavenStealer .

  • MalwareBazaar | ravenstealer
    web:bazaar.abuse.ch

    Malware samples associated with tag ravenstealer MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with ravenstealer . Database ...

  • Telegram Based Raven Stealer Malware Steals Login Credentials, Payment ...
    web:cybersecuritynews.com

    The commodity infostealer landscape has a new entrant in Raven Stealer , a compact Delphi/C++ binary that hijacks Telegram's bot API to spirit away victims' browser secrets. First seen in mid-July 2025 on a GitHub repository operated by the self-styled ZeroTrace Team, Raven arrives either packed ...

  • Raven Stealer malware — IOCs & CVEs | isMalicious
    web:ismalicious.com

    195 indicators of compromise attributed to the Raven Stealer malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.

  • Raven Stealer Unmasked: Telegram-Based Data Exfiltration Analysis
    web:mojoauth.com

    Discover how Raven Stealer exploits Telegram for data theft. Learn about its stealthy techniques, analysis, and crucial mitigation strategies.

  • ThreatFox ...
    web:threatfox.abuse.ch

    Raven Stealer IOC: 07a491805b23d8ebf039f56c43107261a6d3a2014ae39ec513dfb4415220ca73 ( sha256_hash ) You are viewing the ThreatFox database entry for sha256_hash ...

  • ThreatFox ...
    web:threatfox.abuse.ch

    Raven Stealer IOC: 32227233bfaf1e4c4cd26ac665420bd16be281bd291be9c7b77274d70558631e ( sha256_hash ) You are viewing the ThreatFox database entry for sha256_hash ...

  • RAVEN STEALER UNMASKED: Telegram-Based Data Exfiltration.
    web:www.cyfirma.com

    Raven Stealer is a modern, lightweight, information-stealing malware developed primarily in Delphi and C++, designed to extract sensitive data from victim machines with minimal user interaction and high operational stealth. Promoted under the guise of "educational use," Raven Stealer ...

  • Raven Stealer - Malware removal instructions (updated) - PCrisk
    web:www.pcrisk.com

    Raven stealer is a dangerous information-stealing malware that targets a wide range of sensitive data, including browser credentials, cryptocurrency wallets, and payment information.

  • Raven Stealer - Point Wild
    web:www.pointwild.com

    Introduction to Raven Stealer Raven Stealer is a contemporary, lightweight information-stealing malware developed primarily in Delphi and C++. Designed for stealth and efficiency, it operates with minimal user interaction while maintaining a high level of operational concealment.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.