s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-2013334 high

📛 Threat Title

Raven Stealer: SHA1 hash of a malware sample (payload) 562920f28337507f9f25c7d9236191c6333d56b1

Category: Raven Stealer Published: Source updated: First seen: Last updated: Source: Threatfox IOCs/Threats

Description

Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Raven Stealer. Confidence: 95. First seen: 2026-11-03 16:42:47 UTC. Reporter: Grim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha1 562920f28337507f9f25c7d9236191c6333d56b1 VT 42 / 75

IOC database

Type
hash_sha1
Value
562920f28337507f9f25c7d9236191c6333d56b1
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
SHA1 hash of a malware sample (payload) attributed to Raven Stealer

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 42 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Infostealer/Win.Lzveil.R797565
Alibaba malicious Trojan:Win64/ShellcodeRunner.8a559d94
alibabacloud malicious Trojan:Win/ShellcodeRunner.CRY
ALYac malicious Gen:Variant.Yogi.85599
APEX malicious Malicious
Arcabit malicious Trojan.Yogi.D14E5F
Avast malicious FileRepMalware [Pws]
AVG malicious FileRepMalware [Pws]
BitDefender malicious Gen:Variant.Yogi.85599
Bkav malicious W32.Malware.6B6E4F2F
CrowdStrike malicious win/malicious_confidence_70% (D)
CTX malicious dll.unknown.yogi
Cylance malicious Unsafe
Cynet malicious Malicious (score: 100)
DeepInstinct malicious MALICIOUS
Elastic malicious malicious (high confidence)
Emsisoft malicious Gen:Variant.Yogi.85599 (B)
ESET-NOD32 malicious Win64/ShellcodeRunner.CQR trojan
GData malicious Gen:Variant.Yogi.85599
Google malicious Detected
Gridinsoft malicious Trojan.Win64.Agent.sa
huorong malicious Trojan/W64.ShellLoader.ea!crit
Ikarus malicious Win32.Outbreak
K7AntiVirus malicious Trojan ( 006d9bf01 )
K7GW malicious Trojan ( 006d9bf01 )
Kaspersky malicious UDS:Trojan.Win32.Agent
Kingsoft malicious Win32.Trojan.Agent.a
Lionic malicious Trojan.Win32.Convagent.4!c
McAfeeD malicious ti!0026786A999F
Microsoft malicious Trojan:Win32/Wacatac.B!ml
MicroWorld-eScan malicious Gen:Variant.Yogi.85599
Paloalto malicious generic.ml
Panda malicious Trj/PhxBzA.A
Rising malicious Malware.Undefined!8.C (TFE:6:C9WtrIs9t1G)
Sangfor malicious Trojan.Win32.Save.a
Sophos malicious Mal/Generic-S
Symantec malicious Trojan.Gen.MBT
Tencent malicious Win64.Trojan.Shellcoderunner.Kzfl
TrellixENS malicious Artemis!E18B0F4C6BDB
TrendMicro-HouseCall malicious TROJ_GEN.R002H09K226
Varist malicious W64/ABTrojan.NCJI-1499
VIPRE malicious Gen:Variant.Yogi.85599

Details From VirusTotal

Basic Properties
MD5e18b0f4c6bdb6a1810ce828e145cbb39
SHA-1562920f28337507f9f25c7d9236191c6333d56b1
SHA-2560026786a999f1a9ded3a227bdf745f8514f2429b04678caf162328d6683d7ce5
VHash175066656d655d155az49nz8eze
SSDEEP12288:C+qEYCqHbdDNkq9qZwvLIieELXwX1PfJ/TlROHRp8/QjzxwG10EOFKs7fnfl:C+qvJL+ELgXFfJ/TlIHH8/QZhs7vd
TLSHT1F2F41217F29B11A9D421D13C85136969AAA63C100B10AEFF53D4B73E6E7B7D8833EB14
File typeWin32 DLL
File type tagpedll
File extensiondll
MagicPE32+ executable (DLL) (GUI) x86-64, for MS Windows
File size723.5 KB
History
Creation date2026-11-02 20:24 UTC
First seen on VirusTotal2026-11-02 20:56 UTC
Last submission2026-11-02 20:56 UTC
Last analysis2026-11-03 06:04 UTC
Last modified on VirusTotal2026-11-03 20:38 UTC
Known Names
  • 0026786a999f1a9ded3a227bdf745f8514f2429b04678caf162328d6683d7ce5.exe
  • jli.dll
  • lgvi33v.exe

References (2)

  • Malpedia profile Threatfox IOCs/Threats
  • ThreatFox IOC page Threatfox IOCs/Threats

    Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Raven Stealer. Confidence: 95. First seen: 2026-11-03 16:42:47 UTC. Reporter: Grim.

Remediations (10)

  • MalwareBazaar | RavenStealer
    web:bazaar.abuse.ch

    A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as RavenStealer .

  • Hash Checker - File & Malware Hash Lookup | InventiveHQ
    web:inventivehq.com

    Check any file hash in seconds. Paste an MD5, SHA-1 or SHA-256 hash , or drop a file to hash it locally, then check it against live malware feeds.

  • Raven Stealer malware sample d729ca1e148048aa… | isMalicious
    web:ismalicious.com

    Raven Stealer sample d729ca1e148048aa9d42574d0cbd3486407e2746eab45583167336105637bc53: listed by 2 threat sources ( malware , c2). File type, signatures, hashes, reports.

  • Raven Stealer malware — IOCs & CVEs | isMalicious
    web:ismalicious.com

    195 indicators of compromise attributed to the Raven Stealer malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.

  • Raven Stealer Unmasked: Telegram-Based Data Exfiltration Analysis
    web:mojoauth.com

    Discover how Raven Stealer exploits Telegram for data theft. Learn about its stealthy techniques, analysis, and crucial mitigation strategies.

  • ThreatFox | 96a9d4f3996b29f570795ea0464a06c91e2c17b1
    web:threatfox.abuse.ch

    Raven Stealer IOC: 96a9d4f3996b29f570795ea0464a06c91e2c17b1 ( sha1_hash ) ThreatFox IOC Database You are viewing the ThreatFox database entry for sha1_hash ...

  • ThreatFox | 4a1fa50b3789055c8374adc2e2c28617f176e076
    web:threatfox.abuse.ch

    Raven Stealer IOC: 4a1fa50b3789055c8374adc2e2c28617f176e076 ( sha1_hash ) ThreatFox IOC Database You are viewing the ThreatFox database entry for sha1_hash ...

  • RAVEN STEALER UNMASKED: Telegram-Based Data Exfiltration.
    web:www.cyfirma.com

    Raven Stealer is a modern, lightweight, information-stealing malware developed primarily in Delphi and C++, designed to extract sensitive data from victim machines with minimal user interaction and high operational stealth. Promoted under the guise of "educational use," Raven Stealer ...

  • Raven Stealer - Malware removal instructions (updated) - PCrisk
    web:www.pcrisk.com

    Raven stealer is a dangerous information-stealing malware that targets a wide range of sensitive data, including browser credentials, cryptocurrency wallets, and payment information.

  • Raven Stealer - Point Wild
    web:www.pointwild.com

    Introduction to Raven Stealer Raven Stealer is a contemporary, lightweight information-stealing malware developed primarily in Delphi and C++. Designed for stealth and efficiency, it operates with minimal user interaction while maintaining a high level of operational concealment.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.