s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-2013319 high

📛 Threat Title

Raven Stealer: SHA1 hash of a malware sample (payload) 3b2eac656dafc8f76f1d886b25ca89661af48d2f

Category: Raven Stealer Published: Source updated: First seen: Last updated: Source: Threatfox IOCs/Threats

Description

Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Raven Stealer. Confidence: 95. First seen: 2026-11-03 16:42:42 UTC. Reporter: Grim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha1 3b2eac656dafc8f76f1d886b25ca89661af48d2f VT 34 / 75

IOC database

Type
hash_sha1
Value
3b2eac656dafc8f76f1d886b25ca89661af48d2f
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
SHA1 hash of a malware sample (payload) attributed to Raven Stealer

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 34 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious Trojan:Win/Injector_AGen.IN
APEX malicious Malicious
Avast malicious MalwareX-gen [Pws]
AVG malicious MalwareX-gen [Pws]
Avira malicious TR/W64.MalwareX
Bkav malicious W32.Malware.A07AF179
CrowdStrike malicious win/malicious_confidence_70% (W)
Cylance malicious Unsafe
Cynet malicious Malicious (score: 99)
DrWeb malicious Trojan.DownLoader51.64229
Elastic malicious malicious (high confidence)
ESET-NOD32 malicious Win64/Injector_AGen.IY trojan
F-Secure malicious Trojan.TR/W64.MalwareX
Fortinet malicious W64/MALD2.KHQY!tr
GData malicious Win64.Trojan.Agent.5HZB3Z
Google malicious Detected
Gridinsoft malicious Trojan.Win64.Agent.sa
Ikarus malicious Win32.Outbreak
Kaspersky malicious Trojan.Win32.Agent.xyegmn
Kingsoft malicious Win32.Trojan.Agent.xyegmn
Lionic malicious Trojan.Win32.Agent.Y!c
Malwarebytes malicious Trojan.Injector
McAfeeD malicious Trojan:Win/Wacapew.GFV
Microsoft malicious Trojan:Win32/Egairtigado!rfn
Paloalto malicious generic.ml
Panda malicious Trj/PhxBzA.A
Rising malicious Trojan.Kryptik@AI.100 (RDML:Y77OfPzzFiIn0ajxROCEOA)
Sangfor malicious Trojan.Win32.Agent.Vban
SentinelOne malicious Static AI - Suspicious PE
Sophos malicious Mal/Generic-S
Symantec malicious ML.Attribute.HighConfidence
TrellixENS malicious Artemis!A56C203DB9D9
Varist malicious W64/Agent.NJT.gen!Eldorado
Webroot malicious Win.Trojan.Gen

Details From VirusTotal

Basic Properties
MD5a56c203db9d9789fb796a8c7ba683d15
SHA-13b2eac656dafc8f76f1d886b25ca89661af48d2f
SHA-2567695d9e9d5ec2c380dfb70487b800e700ccc696cb7982b9361bb224890e19123
VHash016076656d655d15555az5e3z2@z
SSDEEP12288:hWxkO8cp1esHg8Uekc/ghipX+4vCGlCsw1jZHpQdYx34LL0LL5LLnLLELLILLZLh:AxkFb8Ui/zRZCGlAtZHpQGp
TLSHT1F735296A5F00AFBCFE960072A1314A995A313C3743DC57C7F1AAA2353D265904FF6CA6
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32+ executable (GUI) x86-64, for MS Windows
File size1.0 MB
History
Creation date2026-10-25 14:08 UTC
First seen on VirusTotal2026-11-02 23:12 UTC
Last submission2026-11-03 14:50 UTC
Last analysis2026-11-03 06:31 UTC
Last modified on VirusTotal2026-11-03 20:38 UTC
Known Names
  • Dricre.exe
  • 7695d9e9d5ec2c380dfb70487b800e700ccc696cb7982b9361bb224890e19123.exe
  • launcher.exe
  • c09c2x.exe

References (2)

  • Malpedia profile Threatfox IOCs/Threats
  • ThreatFox IOC page Threatfox IOCs/Threats

    Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Raven Stealer. Confidence: 95. First seen: 2026-11-03 16:42:42 UTC. Reporter: Grim.

Remediations (10)

  • MalwareBazaar | RavenStealer
    web:bazaar.abuse.ch

    A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as RavenStealer .

  • MalwareBazaar | ravenstealer
    web:bazaar.abuse.ch

    Malware samples associated with tag ravenstealer MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with ravenstealer . Database ...

  • Raven Stealer malware sample d729ca1e148048aa… | isMalicious
    web:ismalicious.com

    Raven Stealer malware sample d729ca1e148048aa9d42574d0cbd3486407e2746eab45583167336105637bc53: threat listings, file type, antivirus signatures, public reports and its MD5, SHA-1 and SHA-256, from the isMalicious threat intelligence dataset.

  • Raven Stealer malware — IOCs & CVEs | isMalicious
    web:ismalicious.com

    195 indicators of compromise attributed to the Raven Stealer malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.

  • Raven Stealer Unmasked: Telegram-Based Data Exfiltration Analysis
    web:mojoauth.com

    Discover how Raven Stealer exploits Telegram for data theft. Learn about its stealthy techniques, analysis, and crucial mitigation strategies.

  • ThreatFox | 96a9d4f3996b29f570795ea0464a06c91e2c17b1
    web:threatfox.abuse.ch

    Raven Stealer IOC: 96a9d4f3996b29f570795ea0464a06c91e2c17b1 ( sha1_hash ) ThreatFox IOC Database You are viewing the ThreatFox database entry for sha1_hash ...

  • ThreatFox ...
    web:threatfox.abuse.ch

    Raven Stealer IOC: 32227233bfaf1e4c4cd26ac665420bd16be281bd291be9c7b77274d70558631e (sha256_hash) You are viewing the ThreatFox database entry for sha256_hash ...

  • RAVEN STEALER UNMASKED: Telegram-Based Data Exfiltration.
    web:www.cyfirma.com

    Raven Stealer is a modern, lightweight, information-stealing malware developed primarily in Delphi and C++, designed to extract sensitive data from victim machines with minimal user interaction and high operational stealth. Promoted under the guise of "educational use," Raven Stealer ...

  • Raven Stealer - Malware removal instructions (updated) - PCrisk
    web:www.pcrisk.com

    Raven stealer is a dangerous information-stealing malware that targets a wide range of sensitive data, including browser credentials, cryptocurrency wallets, and payment information.

  • Raven Stealer - Point Wild
    web:www.pointwild.com

    Introduction to Raven Stealer Raven Stealer is a contemporary, lightweight information-stealing malware developed primarily in Delphi and C++. Designed for stealth and efficiency, it operates with minimal user interaction while maintaining a high level of operational concealment.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.