s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-2013333 high

📛 Threat Title

Raven Stealer: SHA256 hash of a malware sample (payload) 0026786a999f1a9ded3a227bdf745f8514f2429b04678caf162328d6683d7ce5

Category: Raven Stealer Published: Source updated: First seen: Last updated: Source: Threatfox IOCs/Threats

Description

Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Raven Stealer. Confidence: 95. First seen: 2026-11-03 16:42:47 UTC. Reporter: Grim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 0026786a999f1a9ded3a227bdf745f8514f2429b04678caf162328d6683d7ce5 VT 42 / 75

IOC database

Type
hash_sha256
Value
0026786a999f1a9ded3a227bdf745f8514f2429b04678caf162328d6683d7ce5
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
WARDENStealer

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 42 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Infostealer/Win.Lzveil.R797565
Alibaba malicious Trojan:Win64/ShellcodeRunner.8a559d94
alibabacloud malicious Trojan:Win/ShellcodeRunner.CRY
ALYac malicious Gen:Variant.Yogi.85599
APEX malicious Malicious
Arcabit malicious Trojan.Yogi.D14E5F
Avast malicious FileRepMalware [Pws]
AVG malicious FileRepMalware [Pws]
BitDefender malicious Gen:Variant.Yogi.85599
Bkav malicious W32.Malware.6B6E4F2F
CrowdStrike malicious win/malicious_confidence_70% (D)
CTX malicious dll.unknown.yogi
Cylance malicious Unsafe
Cynet malicious Malicious (score: 100)
DeepInstinct malicious MALICIOUS
Elastic malicious malicious (high confidence)
Emsisoft malicious Gen:Variant.Yogi.85599 (B)
ESET-NOD32 malicious Win64/ShellcodeRunner.CQR trojan
GData malicious Gen:Variant.Yogi.85599
Google malicious Detected
Gridinsoft malicious Trojan.Win64.Agent.sa
huorong malicious Trojan/W64.ShellLoader.ea!crit
Ikarus malicious Win32.Outbreak
K7AntiVirus malicious Trojan ( 006d9bf01 )
K7GW malicious Trojan ( 006d9bf01 )
Kaspersky malicious UDS:Trojan.Win32.Agent
Kingsoft malicious Win32.Trojan.Agent.a
Lionic malicious Trojan.Win32.Convagent.4!c
McAfeeD malicious ti!0026786A999F
Microsoft malicious Trojan:Win32/Wacatac.B!ml
MicroWorld-eScan malicious Gen:Variant.Yogi.85599
Paloalto malicious generic.ml
Panda malicious Trj/PhxBzA.A
Rising malicious Malware.Undefined!8.C (TFE:6:C9WtrIs9t1G)
Sangfor malicious Trojan.Win32.Save.a
Sophos malicious Mal/Generic-S
Symantec malicious Trojan.Gen.MBT
Tencent malicious Win64.Trojan.Shellcoderunner.Kzfl
TrellixENS malicious Artemis!E18B0F4C6BDB
TrendMicro-HouseCall malicious TROJ_GEN.R002H09K226
Varist malicious W64/ABTrojan.NCJI-1499
VIPRE malicious Gen:Variant.Yogi.85599

Details From VirusTotal

Basic Properties
MD5e18b0f4c6bdb6a1810ce828e145cbb39
SHA-1562920f28337507f9f25c7d9236191c6333d56b1
SHA-2560026786a999f1a9ded3a227bdf745f8514f2429b04678caf162328d6683d7ce5
VHash175066656d655d155az49nz8eze
SSDEEP12288:C+qEYCqHbdDNkq9qZwvLIieELXwX1PfJ/TlROHRp8/QjzxwG10EOFKs7fnfl:C+qvJL+ELgXFfJ/TlIHH8/QZhs7vd
TLSHT1F2F41217F29B11A9D421D13C85136969AAA63C100B10AEFF53D4B73E6E7B7D8833EB14
File typeWin32 DLL
File type tagpedll
File extensiondll
MagicPE32+ executable (DLL) (GUI) x86-64, for MS Windows
File size723.5 KB
History
Creation date2026-11-02 20:24 UTC
First seen on VirusTotal2026-11-02 20:56 UTC
Last submission2026-11-02 20:56 UTC
Last analysis2026-11-03 06:04 UTC
Last modified on VirusTotal2026-11-03 20:38 UTC
Known Names
  • 0026786a999f1a9ded3a227bdf745f8514f2429b04678caf162328d6683d7ce5.exe
  • jli.dll
  • lgvi33v.exe

References (2)

  • Malpedia profile Threatfox IOCs/Threats
  • ThreatFox IOC page Threatfox IOCs/Threats

    Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Raven Stealer. Confidence: 95. First seen: 2026-11-03 16:42:47 UTC. Reporter: Grim.

Remediations (10)

  • MalwareBazaar | RavenStealer
    web:bazaar.abuse.ch

    A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as RavenStealer .

  • MalwareBazaar | ravenstealer
    web:bazaar.abuse.ch

    Malware samples associated with tag ravenstealer MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with ravenstealer . Database ...

  • Telegram Based Raven Stealer Malware Steals Login Credentials, Payment ...
    web:cybersecuritynews.com

    The commodity infostealer landscape has a new entrant in Raven Stealer , a compact Delphi/C++ binary that hijacks Telegram's bot API to spirit away victims' browser secrets. First seen in mid-July 2025 on a GitHub repository operated by the self-styled ZeroTrace Team, Raven arrives either packed ...

  • Raven Stealer malware — IOCs & CVEs | isMalicious
    web:ismalicious.com

    195 indicators of compromise attributed to the Raven Stealer malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.

  • Raven Stealer Unmasked: Telegram-Based Data Exfiltration Analysis
    web:mojoauth.com

    Discover how Raven Stealer exploits Telegram for data theft. Learn about its stealthy techniques, analysis, and crucial mitigation strategies.

  • ThreatFox ...
    web:threatfox.abuse.ch

    Raven Stealer IOC: 32227233bfaf1e4c4cd26ac665420bd16be281bd291be9c7b77274d70558631e ( sha256_hash ) You are viewing the ThreatFox database entry for sha256_hash ...

  • ThreatFox ...
    web:threatfox.abuse.ch

    Raven Stealer IOC: 0ac49697759d9453ad21fd1ac6d70bf3b9baa05ee4b38c528d1cb65d155a6c99 ( sha256_hash ) You are viewing the ThreatFox database entry for sha256_hash ...

  • RAVEN STEALER UNMASKED: Telegram-Based Data Exfiltration.
    web:www.cyfirma.com

    Raven Stealer is a modern, lightweight, information-stealing malware developed primarily in Delphi and C++, designed to extract sensitive data from victim machines with minimal user interaction and high operational stealth. Promoted under the guise of "educational use," Raven Stealer ...

  • Raven Stealer - Malware removal instructions (updated) - PCrisk
    web:www.pcrisk.com

    Raven stealer is a dangerous information-stealing malware that targets a wide range of sensitive data, including browser credentials, cryptocurrency wallets, and payment information.

  • Raven Stealer - Point Wild
    web:www.pointwild.com

    Introduction to Raven Stealer Raven Stealer is a contemporary, lightweight information-stealing malware developed primarily in Delphi and C++. Designed for stealth and efficiency, it operates with minimal user interaction while maintaining a high level of operational concealment.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.