s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-2013292 high

📛 Threat Title

Raven Stealer: SHA256 hash of a malware sample (payload) 9a83346aa14e0afedf499aa8ce74e2c2f83b044e13c34ef39d55d2c47da035e8

Category: Raven Stealer Published: Source updated: First seen: Last updated: Source: Threatfox IOCs/Threats

Description

Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Raven Stealer. Confidence: 95. First seen: 2026-11-03 16:42:33 UTC. Reporter: Grim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 9a83346aa14e0afedf499aa8ce74e2c2f83b044e13c34ef39d55d2c47da035e8 VT 21 / 75

IOC database

Type
hash_sha256
Value
9a83346aa14e0afedf499aa8ce74e2c2f83b044e13c34ef39d55d2c47da035e8
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
WARDENStealer

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 21 of 75 VirusTotal vendors

VendorVerdictDetection
APEX malicious Malicious
Avast malicious Win64:MalwareX-gen [Pws]
AVG malicious Win64:MalwareX-gen [Pws]
Avira malicious TR/W64.MalwareX
Bkav malicious W32.Malware.2BD329BF
CrowdStrike malicious win/malicious_confidence_70% (W)
Cylance malicious Unsafe
Elastic malicious malicious (high confidence)
ESET-NOD32 malicious Win64/Injector.AOW trojan
F-Secure malicious Trojan.TR/W64.MalwareX
Fortinet malicious W64/MALD2.KHQY!tr
GData malicious Win64.Trojan.Agent.NW39RW
Google malicious Detected
Ikarus malicious Trojan.Win32.Wacatac
Kaspersky malicious Trojan.Win32.Agent.xyefns
Malwarebytes malicious Trojan.Injector
Microsoft malicious Program:Win32/Wacapew.C!ml
Rising malicious Trojan.Kryptik@AI.96 (RDML:8Fk6G4Z2EtiHxt0YaKmJDw)
SentinelOne malicious Static AI - Suspicious PE
Symantec malicious ML.Attribute.HighConfidence
Webroot malicious Win.Trojan.Gen

Details From VirusTotal

Basic Properties
MD5d7a16c8087159587359cf5b79ba2676e
SHA-1e4df600490f551e5eba361a582f9cc6b835abdac
SHA-2569a83346aa14e0afedf499aa8ce74e2c2f83b044e13c34ef39d55d2c47da035e8
VHash016076656d655d151557z1005c3z2bz13z5fz
SSDEEP24576:tlWSZaSS0HLf++I6Hie0rZj9H3gqpEFp7Wr:tsyjICgOJ
TLSHT16F353502A7C54DBBFF199C3C85314A139D61681346FA57BE53BC161B1A227848EFBEB0
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32+ executable (GUI) x86-64, for MS Windows
File size1.0 MB
History
Creation date2026-10-20 04:15 UTC
First seen on VirusTotal2026-11-02 13:38 UTC
Last submission2026-11-02 13:38 UTC
Last analysis2026-11-02 13:38 UTC
Last modified on VirusTotal2026-11-04 00:00 UTC
Known Names
  • ivodri.exe
  • sysupdate.exe
  • sysupdate.dat
  • j7ab990.exe
  • sleestak_payload_1.exe

References (2)

  • Malpedia profile Threatfox IOCs/Threats
  • ThreatFox IOC page Threatfox IOCs/Threats

    Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Raven Stealer. Confidence: 95. First seen: 2026-11-03 16:42:33 UTC. Reporter: Grim.

Remediations (10)

  • MalwareBazaar | RavenStealer
    web:bazaar.abuse.ch

    A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as RavenStealer .

  • MalwareBazaar | ravenstealer
    web:bazaar.abuse.ch

    Malware samples associated with tag ravenstealer MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with ravenstealer . Database ...

  • Telegram Based Raven Stealer Malware Steals Login Credentials, Payment ...
    web:cybersecuritynews.com

    The commodity infostealer landscape has a new entrant in Raven Stealer , a compact Delphi/C++ binary that hijacks Telegram's bot API to spirit away victims' browser secrets. First seen in mid-July 2025 on a GitHub repository operated by the self-styled ZeroTrace Team, Raven arrives either packed ...

  • Raven Stealer malware — IOCs & CVEs | isMalicious
    web:ismalicious.com

    195 indicators of compromise attributed to the Raven Stealer malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.

  • Raven Stealer Unmasked: Telegram-Based Data Exfiltration Analysis
    web:mojoauth.com

    Discover how Raven Stealer exploits Telegram for data theft. Learn about its stealthy techniques, analysis, and crucial mitigation strategies.

  • ThreatFox ...
    web:threatfox.abuse.ch

    Raven Stealer IOC: 71058edd6a2d93d0992a4ce10736a99070e28345dc14c66d7383ea9b5da9923b ( sha256_hash ) You are viewing the ThreatFox database entry for sha256_hash ...

  • ThreatFox ...
    web:threatfox.abuse.ch

    Raven Stealer IOC: 32227233bfaf1e4c4cd26ac665420bd16be281bd291be9c7b77274d70558631e ( sha256_hash ) You are viewing the ThreatFox database entry for sha256_hash ...

  • RAVEN STEALER UNMASKED: Telegram-Based Data Exfiltration.
    web:www.cyfirma.com

    Raven Stealer is a modern, lightweight, information-stealing malware developed primarily in Delphi and C++, designed to extract sensitive data from victim machines with minimal user interaction and high operational stealth. Promoted under the guise of "educational use," Raven Stealer ...

  • Raven Stealer - Malware removal instructions (updated) - PCrisk
    web:www.pcrisk.com

    Raven stealer is a dangerous information-stealing malware that targets a wide range of sensitive data, including browser credentials, cryptocurrency wallets, and payment information.

  • Raven Stealer - Point Wild
    web:www.pointwild.com

    Introduction to Raven Stealer Raven Stealer is a contemporary, lightweight information-stealing malware developed primarily in Delphi and C++. Designed for stealth and efficiency, it operates with minimal user interaction while maintaining a high level of operational concealment.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.