Agent Tesla

Malware Family

278 indicators of compromise attributed to Agent Tesla across abuse.ch threat intelligence feeds.

Domains

42

IPs

2

URLs

6

Hashes

228

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&Cpayload

Sample indicators

IndicatorType
narang.cfddomain
mail.outlook-office365.comdomain
ftp.4bagh.netdomain
ftp.sanchezamador.com.mxdomain
ftp.gebzekamlok.comdomain
ftp.fundacionpiaz.orgdomain
ftp.fibrasanchez.comdomain
ftp.dklak.camdomain
ftp.altatsradgez.comdomain
ftp.duct-master.comdomain
ftp.cantablew.topdomain
ftp.orangesac.comdomain
ftp.acellemez.hudomain
ftp.3dsportsgins.comdomain
ftp.dankely.orgdomain
ftp.enogcaen-br.comdomain
ftp.hivimer.comdomain
ftp.horeca-bucuresti.rodomain
ftp.ckzafetyztres.comdomain
ftp.karmanorbuling.orgdomain
68.65.123.172ip
195.250.27.46ip
https://api.telegram.org/bot8565137147:AAE7jjjsdR6xpVh7Pt_AHuEJ8UDtF-iSSYw/url
https://api.telegram.org/bot8217230214:AAGOUmtbDck2-CNNGjuO3EXKCS54muh7-7E/url
https://api.telegram.org/bot8271047137:AAEexDI10mt9IUeumEpriGOSFf1ITlCIW-0/url
https://api.telegram.org/bot8090741855:AAGaFpiYMEzBGakUFm7D8tV7ye1JfBrSC6I/url
https://api.telegram.org/bot8581062014:AAELVYtJQrXBZGQq27PI1H4GchLS-hAB2e4/url
https://api.telegram.org/bot8758444991:AAFF69OIaaE8t3nxSJfNYHB1J5BXA71IuyI/url
1e0852887af0490bf192a9e7d06acf49hash
3692fc83c64796ce846099f9dc651a9b2140c10ehash
0ac806ee073f53b035d805fac4f532fahash
22ce7aa4be44869abd89ae411023739chash
259c9097a874797d7c06c733a96b81325ec2621a793b08883fb86583c1da4938hash
ad383fe7025e956bce4458cbb0106f958489bf9fhash
9c6be60162b611918d074da4f14322909bc031c74e66201219c23370423fcf91hash
f12c120af203e20c35f019ff8eefc52a3cc5fae18b4a55e9a8c835d6ee88f098hash
1eb04dea7065dec90a181264f6538fc74e86a6ade162e8cd02c961c154ba0569hash
39f24666b2fcff117ed4526118a44d6853cc2a82hash
a757a8b09d99acc2835fd0d26541e46chash
9992545ef435706e582bd516988195df8bae9985ff70d30ea2c20dc5206dfe3bhash
2b1f09c4559ffa9c0c4400d2bf96807e14243144c242b4d58d57af2fec004f18hash
dcdfeeea89d07b5bc81e0f61051f34c2hash
c9699aab5b60601b25da974dc06708b0c3b78b4chash
ed4ae654e0bbb7058128fef7bcad32a1hash
791d27fd45d5ac5f25235b46547129adhash
d0e187f73008bdce2ff5a40312cb32d13ed0d69chash
940f0d74f64672c50d4b6ed704aefa743d81b7cdfbeb6666a00f690f80b7b001hash
dd6d0514ba78dbf7e39288b14a9fa36338ca76d3hash