s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-2013326 high

📛 Threat Title

Raven Stealer: MD5 hash of a malware sample (payload) 90422f53fafcfb51cf5a748334d99c3a

Category: Raven Stealer Published: Source updated: First seen: Last updated: Source: Threatfox IOCs/Threats

Description

Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Raven Stealer. Confidence: 95. First seen: 2026-11-03 16:42:45 UTC. Reporter: Grim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_md5 90422f53fafcfb51cf5a748334d99c3a VT 45 / 75

IOC database

Type
hash_md5
Value
90422f53fafcfb51cf5a748334d99c3a
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
MD5 hash of a malware sample (payload) attributed to Raven Stealer

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 45 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Infostealer/Win.Lzveil.R797565
Alibaba malicious Trojan:Win64/ShellcodeRunner.8a559d94
alibabacloud malicious Trojan:Win/ShellcodeRunner.CRY
ALYac malicious Gen:Variant.Yogi.85599
Antiy-AVL malicious Trojan/Win32.DLLhijack
APEX malicious Malicious
Arcabit malicious Trojan.Yogi.D14E5F
Avast malicious Win64:MalwareX-gen [Misc]
AVG malicious Win64:MalwareX-gen [Misc]
Avira malicious TR/W64.Agent
BitDefender malicious Gen:Variant.Yogi.85599
Bkav malicious W32.Malware.DDDBF2C1
CrowdStrike malicious win/malicious_confidence_90% (D)
CTX malicious dll.unknown.yogi
Cylance malicious Unsafe
Cynet malicious Malicious (score: 100)
Elastic malicious malicious (high confidence)
Emsisoft malicious Gen:Variant.Yogi.85599 (B)
ESET-NOD32 malicious Win64/ShellcodeRunner.CQR trojan
F-Secure malicious Trojan.TR/W64.Agent
GData malicious Gen:Variant.Yogi.85599
Google malicious Detected
Gridinsoft malicious Trojan.Win64.Wacatac.sa
huorong malicious Trojan/W64.ShellLoader.ea!crit
Ikarus malicious Win32.Outbreak
K7AntiVirus malicious Trojan ( 006d9bf01 )
K7GW malicious Trojan ( 006d9bf01 )
Kaspersky malicious Trojan.Win32.Agent.xyegsb
Kingsoft malicious Win32.Trojan.Agent.a
Lionic malicious Trojan.Win32.ShellcodeRunner.4!c
McAfeeD malicious ti!8CD439C7280A
Microsoft malicious Trojan:Win32/Wacatac.B!ml
MicroWorld-eScan malicious Gen:Variant.Yogi.85599
Paloalto malicious generic.ml
Panda malicious Trj/PhxBzA.A
Rising malicious Malware.Undefined!8.C (TFE:6:C9WtrIs9t1G)
Sangfor malicious Trojan.Win32.Save.a
SentinelOne malicious Static AI - Suspicious PE
Sophos malicious Mal/Generic-S
Symantec malicious Trojan.Gen.MBT
Tencent malicious Win64.Trojan.Shellcoderunner.Vdkl
TrellixENS malicious Artemis!90422F53FAFC
TrendMicro-HouseCall malicious TROJ_GEN.R002H09K226
Varist malicious W64/ABTrojan.DOIY-3470
VIPRE malicious Gen:Variant.Yogi.85599

Details From VirusTotal

Basic Properties
MD590422f53fafcfb51cf5a748334d99c3a
SHA-195ca2eac1d346c24d5c9569c041c65ce2b0261d9
SHA-2568cd439c7280a220a58cafe479982556ebe8581e53d953684f48a748e2b4b91bc
VHash175066656d655d155az4enzbeze
SSDEEP12288:3x9vBlAUlpWqi9oqNP2AHc6FzdlY1EMEN333cAKU9qkwiDcbINY7kA:3x9vXRqlTHcKzf7RN3376ylNY7
TLSHT146F40254FA8D82FDD025C23986535A15F67238054B61AAFB83D09B3B2F367D0873DBA1
File typeWin32 DLL
File type tagpedll
File extensiondll
MagicPE32+ executable (DLL) (GUI) x86-64, for MS Windows
File size708.5 KB
History
Creation date2026-11-02 17:34 UTC
First seen on VirusTotal2026-11-02 17:45 UTC
Last submission2026-11-02 17:48 UTC
Last analysis2026-11-03 21:09 UTC
Last modified on VirusTotal2026-11-03 23:10 UTC
Known Names
  • 8cd439c7280a220a58cafe479982556ebe8581e53d953684f48a748e2b4b91bc.exe
  • j0djyzna.exe
  • jli.dll

References (2)

  • Malpedia profile Threatfox IOCs/Threats
  • ThreatFox IOC page Threatfox IOCs/Threats

    Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Raven Stealer. Confidence: 95. First seen: 2026-11-03 16:42:45 UTC. Reporter: Grim.

Remediations (10)

  • Raven Malware Distributed via GitHub and Telegram
    web:advisory.eventussecurity.com

    Raven Stealer is a newly exposed information-stealing malware attributed to a threat group known as the ZeroTrace Team. It is distributed through Telegram and GitHub, using a builder written in Delphi and a payload crafted in C++. The malware is designed for ease of use, allowing threat actors to customize and deploy it quickly.

  • MalwareBazaar | Browse malware samples - abuse.ch
    web:bazaar.abuse.ch

    Using the form below, you can search for malware samples by a hash ( MD5 , SHA256, SHA1), imphash, tlsh hash , ClamAV signature, tag or malware family. Browse Database

  • MalwareBazaar | RavenStealer
    web:bazaar.abuse.ch

    A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as RavenStealer .

  • Raven Stealer malware sample 12d98aa4742c04fb… | isMalicious
    web:ismalicious.com

    Raven Stealer sample 12d98aa4742c04fb8c13f8d5e70aea2fba6bca409f0ebefbf361cc05c4c50c37: listed by 2 threat sources ( malware , c2). File type, signatures, hashes, reports.

  • Raven Stealer malware — IOCs & CVEs | isMalicious
    web:ismalicious.com

    195 indicators of compromise attributed to the Raven Stealer malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.

  • Raven Stealer Unmasked: Telegram-Based Data Exfiltration Analysis
    web:mojoauth.com

    Discover how Raven Stealer exploits Telegram for data theft. Learn about its stealthy techniques, analysis, and crucial mitigation strategies.

  • ThreatFox | 89a2b75d9530ba23eb55a6479ed45819
    web:threatfox.abuse.ch

    Raven Stealer IOC: 89a2b75d9530ba23eb55a6479ed45819 ( md5_hash ) You are viewing the ThreatFox database entry for md5_hash 89a2b75d9530ba23eb55a6479ed45819.

  • ThreatFox | f3a52ef1e498c22c5212864cc2e7852e
    web:threatfox.abuse.ch

    Raven Stealer IOC: f3a52ef1e498c22c5212864cc2e7852e ( md5_hash ) You are viewing the ThreatFox database entry for md5_hash f3a52ef1e498c22c5212864cc2e7852e.

  • Raven Stealer - Malware removal instructions (updated) - PCrisk
    web:www.pcrisk.com

    Raven stealer is a dangerous information-stealing malware that targets a wide range of sensitive data, including browser credentials, cryptocurrency wallets, and payment information.

  • Raven Stealer - Point Wild
    web:www.pointwild.com

    Introduction to Raven Stealer Raven Stealer is a contemporary, lightweight information-stealing malware developed primarily in Delphi and C++. Designed for stealth and efficiency, it operates with minimal user interaction while maintaining a high level of operational concealment.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.