IOC Radar
SHA256HighVerifiedSignal 86/100

f73e99799f4ff717036cea15e6b3f2fb9b65da56906ae9d632a22b7ceb98ec3e

First Seen
Aug 4, 2026
Last Seen
Aug 5, 2026
Aug 4
First Seen
1d ago
Aug 5
Last Seen
today
30
Reports
source reports
95%
Confidence
high
Found in 30 reports. Confidence: high. · Confidence scores are heuristic. Verify before acting on results.
SHA-256 Hash
SHA-256 file hash — primary identifier for malware samples.
MISP Category
Artifacts Dropped
Hash Algorithm
SHA256
Confidence
95%
Signal Score
86 / 100
IDS Rule
Yes
Threat Context
Tags

Feed Intelligence Summary

30 reports95% confidence
AM
Abuse.ch MalwareBazaar
1980 IOCs in report
AM
Abuse.ch MalwareBazaar
2268 IOCs in report
AM
Abuse.ch MalwareBazaar
2246 IOCs in report
AM
Abuse.ch MalwareBazaar
1916 IOCs in report
AM
Abuse.ch MalwareBazaar
2272 IOCs in report
AM
Abuse.ch MalwareBazaar
1852 IOCs in report
AM
Abuse.ch MalwareBazaar
2014 IOCs in report
AM
Abuse.ch MalwareBazaar
1810 IOCs in report
AM
Abuse.ch MalwareBazaar
1818 IOCs in report
AM
Abuse.ch MalwareBazaar
1990 IOCs in report

Activity Timeline

26 total obs
Aug 5Aug 4

Threat Activity Heatmap

Less
More
Mon
Wed
Fri
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
·
·
·
Jul
·
·
·
24h
14
Elevated
7d
26
Critical
30d
26
Critical
3mo
26
Critical
Intelligence SummaryAI Generated

The identified SHA-256 hash, f73e99799f4ff717036cea15e6b3f2fb9b65da56906ae9d632a22b7ceb98ec3e, represents a critical security threat associated with a malicious dropper known as 'ObfLoader/Aaga'. This file, frequently disguised as benign documentation such as appointment letters, is designed to facilitate the unauthorized installation of secondary payloads on compromised host systems. The high severity score indicates that this IOC is actively utilized in current cyber-attacks to establish initi…

Threat ScoreHigh Risk
86
SIGNAL
Signal Score
95%
Confidence
30
Reports
First seenAug 4, 2026
Last seenAug 5, 2026
Verified IOC

VirusTotal

Not checked

WHOIS

description
ASCII text, with very long lines (645u), with CRLF line terminators

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

high
First detected 1 day ago · Last seen today
Appeared in 30 threat reports from 10 sources