TF-2013293
high
📛 Threat Title
Raven Stealer: SHA1 hash of a malware sample (payload) e4df600490f551e5eba361a582f9cc6b835abdac
Description
Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Raven Stealer. Confidence: 95. First seen: 2026-11-03 16:42:33 UTC. Reporter: Grim.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha1
e4df600490f551e5eba361a582f9cc6b835abdac
IOC database
- Type
- hash_sha1
- Value
e4df600490f551e5eba361a582f9cc6b835abdac- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- SHA1 hash of a malware sample (payload) attributed to Raven Stealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Raven Stealer. Confidence: 95. First seen: 2026-11-03 16:42:33 UTC. Reporter: Grim.
Remediations (10)
-
web:advisory.eventussecurity.com
Raven Stealer is a newly exposed information-stealing malware attributed to a threat group known as the ZeroTrace Team. It is distributed through Telegram and GitHub, using a builder written in Delphi and a payload crafted in C++. The malware is designed for ease of use, allowing threat actors to customize and deploy it quickly.
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as RavenStealer .
-
web:ismalicious.com
Raven Stealer sample 0550a6acf8888eb660a8e7304ac6a789c3f2dc0ea51b25bec438655d03bc9628: listed by 2 threat sources ( malware , c2). File type, signatures, hashes, reports.
-
web:ismalicious.com
195 indicators of compromise attributed to the Raven Stealer malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.
-
web:mojoauth.com
Discover how Raven Stealer exploits Telegram for data theft. Learn about its stealthy techniques, analysis, and crucial mitigation strategies.
-
web:threatfox.abuse.ch
Raven Stealer IOC: 96a9d4f3996b29f570795ea0464a06c91e2c17b1 ( sha1_hash ) ThreatFox IOC Database You are viewing the ThreatFox database entry for sha1_hash ...
-
web:threatfox.abuse.ch
Raven Stealer IOC: 4a1fa50b3789055c8374adc2e2c28617f176e076 ( sha1_hash ) ThreatFox IOC Database You are viewing the ThreatFox database entry for sha1_hash ...
-
web:www.cyfirma.com
Raven Stealer is a modern, lightweight, information-stealing malware developed primarily in Delphi and C++, designed to extract sensitive data from victim machines with minimal user interaction and high operational stealth. Promoted under the guise of "educational use," Raven Stealer ...
-
web:www.pcrisk.com
Raven stealer is a dangerous information-stealing malware that targets a wide range of sensitive data, including browser credentials, cryptocurrency wallets, and payment information.
-
web:www.pointwild.com
Introduction to Raven Stealer Raven Stealer is a contemporary, lightweight information-stealing malware developed primarily in Delphi and C++. Designed for stealth and efficiency, it operates with minimal user interaction while maintaining a high level of operational concealment.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.