Raven Stealer is a Delphi/C++ information-stealer that targets Chromium-based browsers to harvest credentials, cookies, autofill data, and payment information, then exfiltrates collected artifacts via Telegram bot integration. The builder embeds plaintext Telegram Chat_ID and Bot_Token into the payload resources and uses in-memory ChaCha20-encrypted DLL injection into Chromium processes to evade detection. #RavenStealer #Telegram
Keypoints
- Raven Stealer is developed in Delphi and C++ with a modular builder that embeds payloads and configuration into the executable resource section.
- The malware targets Chromium-based browsers (Chrome, Edge, Brave) to extract saved passwords, cookies, autofill entries, and payment data.
- The builder stores Telegram Chat_ID and Bot_Token as plaintext resource entries (IDs 102 and 103), enabling direct exfiltration via Telegram API.
- Payloads use ChaCha20 encryption for embedded DLLs and perform in-memory decryption and reflective process hollowing into a suspended Chromium process to avoid disk writes.
- Stolen artifacts are consolidated under %Local%RavenStealer and saved as plaintext files (cookies.txt, passwords.txt, payment.txt) and as a ZIP archive for transmission.
- Distribution is commonly through underground forums and cracked software bundles; each generated payload receives a random 12-character filename to evade signature detection.
- Detection and mitigation recommendations include behavioural detection, monitoring Telegram traffic, user education, consistent patching, and endpoint protection.
MITRE Techniques
- [T1003 ] OS Credential Dumping – Enumerates and extracts stored browser credentials and local vaults from Chromium-based browsers (“…steals credentials from various applications…accessing local storage paths and credential vaults…”).
- [T1552 ] Unsecured Credentials – Embeds Telegram Chat_ID and Bot_Token as plaintext in resources (resource IDs 102 and 103) enabling direct use of credentials (“…embeds sensitive Telegram credentials, specifically the Chat_ID and Bot_Token as plain text within its resource section…”).
- [T1574 ] Hijack Execution Flow – Reflective process hollowing into a suspended Chromium process to run malicious DLL in-memory (“…a new Chromium browser instance is launched in a suspended state…the decrypted DLL is injected into the suspended process…”).
- [T1055 ] Process Injection – Decrypts DLL in memory and injects it into a legitimate Chromium process to execute without dropping files (“…DLL is decrypted in memory only, avoiding disk writes…Reflective Process Hollowing…”).
- [T1041 ] Exfiltration Over C2 Channel – Uses Telegram bot API to send collected ZIP archive to attacker (“…The ZIP file is sent to the attacker via Telegram using the API endpoint: https://api.telegram.org/bot/sendDocument”).
- [T1027 ] Obfuscated Files or Information – Uses ChaCha20 encryption and high-entropy embedded resources (entropy ~8.0) to hide payloads (“…Encrypted Payload: Malware embeds its main DLL payload using ChaCha20 encryption…Entropy analysis reveals a value of 8.0…”).
- [T1204 ] User Execution – Distributed via cracked software and underground forums that rely on user execution to install the stealer (“…distribution often occurs through underground forums or bundled with cracked software…”).
Indicators of Compromise
- [File Hash ] Raven Stealer initial EXE – SHA256: 2b24885942253784e0f6617b26f5e6a05b8ad45f092d2856473439fa6e095ce4 (also MD5: 7e281e88…, SHA-1: b91e7699…)
- [File Hash ] Generated payload EXE – SHA256: 65ca89993f2ee21b95362e151a7cfc50b87183bf0e9c5b753c5e5e17b46f8c24 (MD5: 79a34043…, SHA-1: 9c7c0e08…)
- [File Path ] Stolen artifact files – Stored under C:UsersAppDataLocalRavenStealer, examples: cookies.txt, passwords.txt (and payment.txt).
- [Filename ] Example generated payload name – 65a16KM1.69n.exe (builder produces random 12-character filenames, e.g., 65a16KM1.69n.exe and others).
- [Network ] Telegram API endpoint used for exfiltration – https://api.telegram.org/bot/sendDocument (observed failed attempt with HTTP 404 indicating invalid/expired token).
Read more: https://www.pointwild.com/threat-intelligence/raven-stealer