ThreatFox IOC Database
You are viewing the ThreatFox database entry for url https://api.telegram.org/bot5052159294:AAGb4scUToOAE18Lp5a50ojpRkmgPK8UWdo/sendMessage?chat_id=5057579972.
Database Entry
This IOC expired
This IOC is an old IOC and hence has expired on 2026-09-15 10:39:25 UTC. We therefore refrain from exporting it into our datasets. As a result, this database entry is purely informational and has no impact.
| IOC ID: | 297595 |
|---|---|
| IOC: | https://api.telegram.org/bot5052159294:AAGb4scUToOAE18Lp5a50ojpRkmgPK8UWdo/sendMessage?chat_id=5057579972 |
| IOC Type : | url |
| Threat Type : | botnet_cc |
| Malware: | 404 Keylogger |
| Malware alias: | 404KeyLogger, Snake Keylogger |
| Confidence Level : | Confidence level is high (100%) |
| Is compromised? : | False |
| ASN: | AS62041 Telegram |
| Country: |  VG |
| First seen: | 2022-01-17 18:44:12 UTC |
| Last seen: | never |
| UUID: | 768b0fd4-77c5-11ec-8ab6-42010aa4000a |
| Reporter |  AndreGironda |
| Reward | 5 credits from ThreatFox |
| Tags: | 404keylogger Snake SnakeKeylogger |
| Reference: | https://tria.ge/220117-vn4q9sbgem |
AndreGironda
MITRE T1566.001Date: Sun, 16 Jan 2022 19:30-20:00 -0800
Received: from zico.vvgcbdsales.example.com (unknown [87.239.255.100])
Content-Type: multipart/mixed; boundary="===============0316607688=="
MIME-Version: 1.0
Subject: Döviz Transfer Isleminiz
To: Vakif Katilim <Vakif.Katilim@vakifkatilim.com.tr>
From: Vakif Katilim <Vakif.Katilim@vakifkatilim.com.tr>
Reply-To: bahar.demir@halkbank.com.tr
Message-Id: <20220117035740.28C23705B78@mx.diyarbakiroto.com.tr>
Return-Path: Vakif.Katilim@vakifkatilim.com.tr
Attachment Name: SWIFT MESAJI.rar
Attachment SHA256: 159b2e6084abe66f45bf5bd12dcdcbb314a318a41ce65cdd6a03d19f89692fa1
RAR_Encapsulated_Executable Name: SWIFT MESAJI.exe
Executable SHA256: 64140ddcfabd8c1711c8fbbf29b503477e060ceea059a50d5d9382fa4e585fd3
Unpacked SnakeKeylogger Executable SHA256: fe793eafd7d61f4d76cc0bc883c25cf3b3ea573ac7e572dd087dcc0dcd541fab