s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-2013320 high

📛 Threat Title

Raven Stealer: MD5 hash of a malware sample (payload) a56c203db9d9789fb796a8c7ba683d15

Category: Raven Stealer Published: Source updated: First seen: Last updated: Source: Threatfox IOCs/Threats

Description

Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Raven Stealer. Confidence: 95. First seen: 2026-11-03 16:42:43 UTC. Reporter: Grim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_md5 a56c203db9d9789fb796a8c7ba683d15 VT 34 / 75

IOC database

Type
hash_md5
Value
a56c203db9d9789fb796a8c7ba683d15
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
MD5 hash of a malware sample (payload) attributed to Raven Stealer

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 34 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious Trojan:Win/Injector_AGen.IN
APEX malicious Malicious
Avast malicious MalwareX-gen [Pws]
AVG malicious MalwareX-gen [Pws]
Avira malicious TR/W64.MalwareX
Bkav malicious W32.Malware.A07AF179
CrowdStrike malicious win/malicious_confidence_70% (W)
Cylance malicious Unsafe
Cynet malicious Malicious (score: 99)
DrWeb malicious Trojan.DownLoader51.64229
Elastic malicious malicious (high confidence)
ESET-NOD32 malicious Win64/Injector_AGen.IY trojan
F-Secure malicious Trojan.TR/W64.MalwareX
Fortinet malicious W64/MALD2.KHQY!tr
GData malicious Win64.Trojan.Agent.5HZB3Z
Google malicious Detected
Gridinsoft malicious Trojan.Win64.Agent.sa
Ikarus malicious Win32.Outbreak
Kaspersky malicious Trojan.Win32.Agent.xyegmn
Kingsoft malicious Win32.Trojan.Agent.xyegmn
Lionic malicious Trojan.Win32.Agent.Y!c
Malwarebytes malicious Trojan.Injector
McAfeeD malicious Trojan:Win/Wacapew.GFV
Microsoft malicious Trojan:Win32/Egairtigado!rfn
Paloalto malicious generic.ml
Panda malicious Trj/PhxBzA.A
Rising malicious Trojan.Kryptik@AI.100 (RDML:Y77OfPzzFiIn0ajxROCEOA)
Sangfor malicious Trojan.Win32.Agent.Vban
SentinelOne malicious Static AI - Suspicious PE
Sophos malicious Mal/Generic-S
Symantec malicious ML.Attribute.HighConfidence
TrellixENS malicious Artemis!A56C203DB9D9
Varist malicious W64/Agent.NJT.gen!Eldorado
Webroot malicious Win.Trojan.Gen

Details From VirusTotal

Basic Properties
MD5a56c203db9d9789fb796a8c7ba683d15
SHA-13b2eac656dafc8f76f1d886b25ca89661af48d2f
SHA-2567695d9e9d5ec2c380dfb70487b800e700ccc696cb7982b9361bb224890e19123
VHash016076656d655d15555az5e3z2@z
SSDEEP12288:hWxkO8cp1esHg8Uekc/ghipX+4vCGlCsw1jZHpQdYx34LL0LL5LLnLLELLILLZLh:AxkFb8Ui/zRZCGlAtZHpQGp
TLSHT1F735296A5F00AFBCFE960072A1314A995A313C3743DC57C7F1AAA2353D265904FF6CA6
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32+ executable (GUI) x86-64, for MS Windows
File size1.0 MB
History
Creation date2026-10-25 14:08 UTC
First seen on VirusTotal2026-11-02 23:12 UTC
Last submission2026-11-03 14:50 UTC
Last analysis2026-11-03 06:31 UTC
Last modified on VirusTotal2026-11-03 20:38 UTC
Known Names
  • Dricre.exe
  • 7695d9e9d5ec2c380dfb70487b800e700ccc696cb7982b9361bb224890e19123.exe
  • launcher.exe
  • c09c2x.exe

References (2)

  • Malpedia profile Threatfox IOCs/Threats
  • ThreatFox IOC page Threatfox IOCs/Threats

    Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Raven Stealer. Confidence: 95. First seen: 2026-11-03 16:42:43 UTC. Reporter: Grim.

Remediations (10)

  • MalwareBazaar | Browse malware samples - abuse.ch
    web:bazaar.abuse.ch

    Using the form below, you can search for malware samples by a hash ( MD5 , SHA256, SHA1), imphash, tlsh hash , ClamAV signature, tag or malware family. Browse Database

  • Hash Reputation Checker — MD5/SHA-256 Malware Lookup
    web:cipherssecurity.com

    Check MD5 , SHA-1, or SHA-256 file hashes against MalwareBazaar and VirusTotal feeds. Drop a file — hashing happens in your browser, never uploaded.

  • Malware Hash Lookup — Check MD5, SHA-1 & SHA-256
    web:imalware.com

    It compares a file's fingerprint (its MD5 , SHA-1 or SHA-256 hash ) with a list of fingerprints of known malware . If the hash matches, the file is identical to a known malicious sample .

  • Raven Stealer malware sample 0550a6acf8888eb6… | isMalicious
    web:ismalicious.com

    Raven Stealer sample 0550a6acf8888eb660a8e7304ac6a789c3f2dc0ea51b25bec438655d03bc9628: listed by 2 threat sources ( malware , c2). File type, signatures, hashes, reports.

  • Raven Stealer malware — IOCs & CVEs | isMalicious
    web:ismalicious.com

    195 indicators of compromise attributed to the Raven Stealer malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.

  • Raven Stealer Unmasked: Telegram-Based Data Exfiltration Analysis
    web:mojoauth.com

    Discover how Raven Stealer exploits Telegram for data theft. Learn about its stealthy techniques, analysis, and crucial mitigation strategies.

  • ThreatFox | 89a2b75d9530ba23eb55a6479ed45819
    web:threatfox.abuse.ch

    Raven Stealer IOC: 89a2b75d9530ba23eb55a6479ed45819 ( md5_hash ) You are viewing the ThreatFox database entry for md5_hash 89a2b75d9530ba23eb55a6479ed45819.

  • ThreatFox | 60e43d6b394a5347a8d179a05a8e4b59
    web:threatfox.abuse.ch

    Raven Stealer IOC: 60e43d6b394a5347a8d179a05a8e4b59 ( md5_hash ) You are viewing the ThreatFox database entry for md5_hash 60e43d6b394a5347a8d179a05a8e4b59.

  • RAVEN STEALER UNMASKED: Telegram-Based Data Exfiltration.
    web:www.cyfirma.com

    Raven Stealer is a modern, lightweight, information-stealing malware developed primarily in Delphi and C++, designed to extract sensitive data from victim machines with minimal user interaction and high operational stealth. Promoted under the guise of "educational use," Raven Stealer ...

  • Raven Stealer - Point Wild
    web:www.pointwild.com

    Introduction to Raven Stealer Raven Stealer is a contemporary, lightweight information-stealing malware developed primarily in Delphi and C++. Designed for stealth and efficiency, it operates with minimal user interaction while maintaining a high level of operational concealment.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.