Skip to main content

Agent Tesla

Malware Family

400 indicators of compromise attributed to Agent Tesla across abuse.ch threat intelligence feeds.

Domains

60

IPs

3

URLs

7

Hashes

330

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (60)IPs (3)URLs (7)Hashes (330)

For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
ftp.bookingreg.fitdomain
ftp.ulfl.co.indomain
mail.voestelpine.comdomain
ftp.melrz.comdomain
ftp.fundacionpiaz.orgdomain
ftp.elsyexpertise.comdomain
ftp.fibrasanchez.comdomain
ftp.maytestlasb.comdomain
ftp.orangesac.comdomain
ftp.acellemez.hudomain
ftp.hivimer.comdomain
mail.iaa-airferight.comdomain
ftp.gaiadeqi.comdomain
ftp.ckzafetyztres.comdomain
ftp.karmanorbuling.orgdomain
avenix.icudomain
avenix.worlddomain
bedavasorgupaneli.helpdomain
rivex.loldomain
ftp.sequences.digitaldomain
68.65.123.172ip
195.250.27.46ip
91.204.209.32ip
https://api.telegram.org/bot8581062014:AAELVYtJQrXBZGQq27PI1H4GchLS-hAB2e4/url
https://api.telegram.org/bot8271047137:AAEexDI10mt9IUeumEpriGOSFf1ITlCIW-0/url
https://api.telegram.org/bot8217230214:AAGOUmtbDck2-CNNGjuO3EXKCS54muh7-7E/url
https://api.telegram.org/bot8758444991:AAFF69OIaaE8t3nxSJfNYHB1J5BXA71IuyI/url
https://api.telegram.org/bot8565137147:AAE7jjjsdR6xpVh7Pt_AHuEJ8UDtF-iSSYw/url
https://gfnstuff.pages.dev/GalacticToolsV3.exeurl
https://api.telegram.org/bot8090741855:AAGaFpiYMEzBGakUFm7D8tV7ye1JfBrSC6I/url
2175956d0b3614ceeb7fe80d45bfc600c1a41347hash
e6290924b6e7a434776239ae19e79b02e88c3a6bef1b0e1d61041cc4176dec6ehash
9c6be60162b611918d074da4f14322909bc031c74e66201219c23370423fcf91hash
1fb0b0a0efd6dac97031183a16a3c1ffb7dbf4a77912280d741cd6fca29c47c5hash
58328b7f4fecb0407da1947937b41162e23a61559d6f49526ec1683febad6ddchash
2b1f09c4559ffa9c0c4400d2bf96807e14243144c242b4d58d57af2fec004f18hash
ab3d42f5dc68cfd3507849160e1b5f90589c49f1bc8aea1226a1dea6e2824c05hash
e130fb44008595cc59028b23ee7c616e3c927a8ccdc03b0972a690e0378b0265hash
b0e94f6295e469e77f16759ad1a117e4f5c120455032f375b38660f050bbf9cahash
e4a8efef165b15db21b9aa1fa13586119c9b433ehash
3a9e07ad7d205d67d2e1e2608fc85c9a92418380hash
452a92a4ff9639259c0aae08fcb4fe30e93c8843a4cf301b9746e8e6b899bb74hash
73d3a30675edff0224cfaeef1b578b66hash
59ac907b206d131077ec0dea4ab35b8c32adee52hash
183573ffe3b0c5f9188c5fab6b80ebechash
132fd7e557ae7b95f7dc8c2b5bbefe06hash
8ed2be4f406cd7012bbc432229c8938a97f02b5ahash
78be24965e3c95bcc64de28e51e9ddf7ad91ce920a05a483a8cdf7e1be80294dhash
febda06706ab7857137688cc58c12d4f144815a2hash
8365a58fe73a021c914e57868087df4299d61dfdfd34e00cc89e496aa18c0572hash

Another file to check? Run a file hash reputation check.