medium
advisory
Raven Stealer malware distribution
ThreatFox identified 12 new samples of the Raven Stealer info-stealer targeting Windows environments.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 5, 13:39 UTC
- Detection
- 8 IOCs
- Source quality
- A1Likely
Abuse.ch ThreatFox reported 12 new samples of the Raven Stealer malware on November 4, 2026. These indicators represent newly identified malicious payloads currently associated with the Raven Stealer operation.
Recommendation
- Block the SHA-256 and MD5 hashes listed in this brief at the enterprise perimeter and endpoint security solutions.
- Implement file integrity monitoring and endpoint detection to identify execution attempts of these hashes.
- Scan historical logs for the presence of these indicators to identify potential prior compromise.
Immediate actions
Block listed file hashes at the endpoint security layer.
SOC
24h
Threat Hunt
Search for execution of files matching listed hash values.
T1059
high
high confidence
hunt now
Data: Endpoint telemetry (FileCreate, ProcessCreation)
Indicators of compromise
4
hash_md5
4
hash_sha256
| Type | Value |
|---|---|
| hash_md5 | 0a57fc056b96c08fd3be2f2014b1fa14 |
| hash_sha256 | 768f46d4dc306502ce6b847b1a06509a9301fc44794cc3d70858657278d30ab7 |
| hash_md5 | d365cdc3de06463bc6cf427da426b161 |
| hash_sha256 | fd77ac53f8943ff412fae6815b0335a824e5d671951fe4cb00da84f499f4c372 |
| hash_md5 | e8a94512c9479db23c0e99a1f187662d |
| hash_sha256 | d2b60bb3b7af913b210a589a5256ea9054c4719e8b626eb2c26626e0a62652f5 |
| hash_md5 | 3bb88057a5cb80e80d7b8394d10fe4e6 |
| hash_sha256 | 08b2c0d4baf3be0329a687354d9257d46d7256c4159c2d826fc507ad0d6abad0 |