TF-2013325
high
📛 Threat Title
Raven Stealer: SHA1 hash of a malware sample (payload) 95ca2eac1d346c24d5c9569c041c65ce2b0261d9
Description
Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Raven Stealer. Confidence: 95. First seen: 2026-11-03 16:42:44 UTC. Reporter: Grim.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha1
95ca2eac1d346c24d5c9569c041c65ce2b0261d9
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/95ca2eac1d346c24d5c9569c041c65ce2b0261d9
IOC database
- Type
- hash_sha1
- Value
95ca2eac1d346c24d5c9569c041c65ce2b0261d9- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- SHA1 hash of a malware sample (payload) attributed to Raven Stealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/95ca2eac1d346c24d5c9569c041c65ce2b0261d9
References (2)
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Raven Stealer. Confidence: 95. First seen: 2026-11-03 16:42:44 UTC. Reporter: Grim.
Remediations (10)
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as RavenStealer .
-
web:imalware.com
It compares a file's fingerprint (its MD5, SHA-1 or SHA-256 hash ) with a list of fingerprints of known malware . If the hash matches, the file is identical to a known malicious sample .
-
web:inventivehq.com
Check any file hash in seconds. Paste an MD5, SHA-1 or SHA-256 hash , or drop a file to hash it locally, then check it against live malware feeds.
-
web:ismalicious.com
Raven Stealer malware sample 361bd7099675c603b2ae6c76ea233d2298052306b7141f11e9f5d815ccf18473: threat listings, file type, antivirus signatures, public reports and its MD5, SHA-1 and SHA-256, from the isMalicious threat intelligence dataset.
-
web:ismalicious.com
195 indicators of compromise attributed to the Raven Stealer malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.
-
web:mojoauth.com
Discover how Raven Stealer exploits Telegram for data theft. Learn about its stealthy techniques, analysis, and crucial mitigation strategies.
-
web:threatfox.abuse.ch
Raven Stealer IOC: 01e8dac1d83983c74e156d3dea16724487c00cb1 ( sha1_hash ) You are viewing the ThreatFox database entry for sha1_hash ...
-
web:threatfox.abuse.ch
Raven Stealer IOC: ca74c58aee1dddd51fcd6bfe909e28237c19749f ( sha1_hash ) You are viewing the ThreatFox database entry for sha1_hash ...
-
web:www.pcrisk.com
Raven stealer is a dangerous information-stealing malware that targets a wide range of sensitive data, including browser credentials, cryptocurrency wallets, and payment information.
-
web:www.pointwild.com
Introduction to Raven Stealer Raven Stealer is a contemporary, lightweight information-stealing malware developed primarily in Delphi and C++. Designed for stealth and efficiency, it operates with minimal user interaction while maintaining a high level of operational concealment.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.