EXECUTIVE SUMMARY:
Raven Stealer is a newly exposed information-stealing malware attributed to a threat group known as the ZeroTrace Team. It is distributed through Telegram and GitHub, using a builder written in Delphi and a payload crafted in C++. The malware is designed for ease of use, allowing threat actors to customize and deploy it quickly. Its popularity stems from its accessibility, real-time support via Telegram, and ability to exfiltrate stolen data directly to attacker-controlled channels. This combination of convenience, stealth, and modularity has made Raven Stealer appealing to both advanced and amateur threat actors. Its emergence highlights the increasing commercialization of cybercrime, where malware is marketed and shared like software-as-a-service.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
Raven Stealer is a newly exposed information-stealing malware attributed to a threat group known as the ZeroTrace Team. It is distributed through Telegram and GitHub, using a builder written in Delphi and a payload crafted in C++. The malware is designed for ease of use, allowing threat actors to customize and deploy it quickly. Its popularity stems from its accessibility, real-time support via Telegram, and ability to exfiltrate stolen data directly to attacker-controlled channels. This combination of convenience, stealth, and modularity has made Raven Stealer appealing to both advanced and amateur threat actors. Its emergence highlights the increasing commercialization of cybercrime, where malware is marketed and shared like software-as-a-service.[emaillocker id="1283"]
Raven Stealer uses a UPX-packed payload and runs entirely in memory to avoid detection. It launches a headless Chromium browser, injects a ChaCha20-encrypted DLL using direct syscalls, and harvests sensitive data including passwords, cookies, autofill data, VPN credentials, and cryptocurrency wallets. The data is organized into folders and compressed into a ZIP file, which is then exfiltrated via Telegram's public API using embedded bot credentials. Its use of reflective injection, system-level APIs, and encrypted payloads enables it to bypass traditional defenses. The builder automates the process, embedding all required communication tokens at compile time, streamlining deployment for attackers.
Raven Stealer reflects a growing trend in which malware is built for mass use and rapid deployment. Its stealthy execution, in-memory techniques, and use of legitimate platforms like Telegram make it harder to detect and block. The threat actor's use of public forums for distribution and support lowers the technical barrier for cybercriminals, increasing the malware’s reach. To defend against such threats, organizations must rely on behavior-based detection, restrict unusual process activity, monitor outbound traffic to messaging APIs, and enforce strong credential management. Awareness and layered defense remain key in countering threats like Raven Stealer.
THREAT PROFILE:
| Tactic | Technique ID | Technique | Sub-Technique |
| Initial Access | T1204.002 | User Execution | Malicious File |
| Defense Evasion | T1027.002 | Obfuscated Files or Information | Software Packing |
| T1055.002 | Process Injection | Portable Executable Injection | |
| Defense Evasion | T1106 | Native API | — |
| Credential Access | T1555.003 | Credentials from Password Stores | Credentials from Web Browsers |
| Collection | T1113 | Screen Capture | — |
| T1005 | Data from Local System | — | |
| Command and Control | T1102.002 | Web Service | Bidirectional Communication |
| Exfiltration | T1041 | Exfiltration Over C2 Channel | — |
MBC MAPPING:
| Objective | Behaviour ID | Behaviour |
| Collection | E1113.m01 | Screen Capture (WinAPI) |
| Credential Access | F0002.002 | Keylogging (Polling) |
| Discovery | E1082.m02 | Enumerate Environment Variables |
| Command and Control | B0030.001 | Send Data |
| Defense Evasion | F0005.002 | Hidden Files (Location) |
| Anti-Behavioral Analysis | B0009.004 | Check Processes |
| Execution | E1204 | User Execution |
| Data Micro-objective | C0026.002 | XOR Encode Data |
| File System Micro-objective | C0051 | Read File |
REFERENCES:
The following reports contain further technical details:
[/emaillocker]