ThreatFox IOC Database
You are viewing the ThreatFox database entry for url https://api.telegram.org/bot1697675911:AAHV0Bbn9deoaAv_7ZCAnyZh1OG-0RuJcOo/sendDocument.
Database Entry
This IOC expired
This IOC is an old IOC and hence has expired on 2026-09-15 10:39:25 UTC. We therefore refrain from exporting it into our datasets. As a result, this database entry is purely informational and has no impact.
| IOC ID: | 232856 |
|---|---|
| IOC: | https://api.telegram.org/bot1697675911:AAHV0Bbn9deoaAv_7ZCAnyZh1OG-0RuJcOo/sendDocument |
| IOC Type : | url |
| Threat Type : | botnet_cc |
| Malware: | Agent Tesla |
| Malware alias: | AgenTesla, AgentTesla, Negasteal |
| Confidence Level : | Confidence level is high (100%) |
| Is compromised? : | False |
| ASN: | AS62041 Telegram |
| Country: |  VG |
| First seen: | 2021-10-12 03:46:09 UTC |
| Last seen: | never |
| UUID: | ef8ca2bc-2b0e-11ec-a35f-42010aa4000a |
| Reporter |  AndreGironda |
| Reward | 5 credits from ThreatFox |
| Tags: | AgentTesla AgentTeslaV3 |
| Reference: | https://tria.ge/211012-d5t5qabacq |
AndreGironda
MITRE T1566.001Date: Sun, 10 Oct 2021 21:00-21:30 -0700
Received: from slot0.pacifcpkg.com (92.52.218.72)
Content-Type: multipart/mixed; boundary="===============0873990666=="
MIME-Version: 1.0
Subject: Re:order,
From: "Vany" <vanyego@pacifcpkg.com>
Message-ID: <0.0.1.411.1D7BE561E6C7512.0@slot0.pacifcpkg.com>
Return-Path: vanyego@pacifcpkg.com
Attachment Name: PO56894833.cab
Attachment Zipfile SHA256: da7b4d88149e640933fbad7a71fb4eb8c102c226873efedba4820dc9b1d3958a
Unzipped Executable Name: PO56894833.exe
Executable SHA256: 4eaf4ef36172aca924bc5501215112d4675390a7b4e14e6bc70f948494779a00
Unpacked AgentTesla Executable SHA256: f0fe80b0c3077bf2524eafc227f5dfa01536b67310fe9f9b4c686a163d21b967