Skip to main content

Agent Tesla

Malware Family

341 indicators of compromise attributed to Agent Tesla across abuse.ch threat intelligence feeds.

Domains

60

IPs

2

URLs

7

Hashes

272

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (60)IPs (2)URLs (7)Hashes (272)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
ftp.untentepc.infodomain
narang.cfddomain
mail.outlook-office365.comdomain
ftp.holzbrenzii.comdomain
ftp.4bagh.netdomain
ftp.zetrocom.mydomain
ftp.elsyexpertise.comdomain
ftp.altatsradgez.comdomain
ftp.duct-master.comdomain
ftp.3dsportsgins.comdomain
ftp.hivimer.comdomain
ftp.avion.com.sgdomain
ftp.vilimorin.comdomain
mail.iaa-airferight.comdomain
ftp.horeca-bucuresti.rodomain
sorgupaneli.lifedomain
ruuhsuzpanel.cyoudomain
ruhsuzpanel.topdomain
karakocsystem.xyzdomain
avenix.loldomain
68.65.123.172ip
195.250.27.46ip
https://api.telegram.org/bot8581062014:AAELVYtJQrXBZGQq27PI1H4GchLS-hAB2e4/url
https://api.telegram.org/bot8271047137:AAEexDI10mt9IUeumEpriGOSFf1ITlCIW-0/url
https://api.telegram.org/bot8217230214:AAGOUmtbDck2-CNNGjuO3EXKCS54muh7-7E/url
https://api.telegram.org/bot8758444991:AAFF69OIaaE8t3nxSJfNYHB1J5BXA71IuyI/url
https://api.telegram.org/bot8565137147:AAE7jjjsdR6xpVh7Pt_AHuEJ8UDtF-iSSYw/url
https://gfnstuff.pages.dev/GalacticToolsV3.exeurl
https://api.telegram.org/bot8090741855:AAGaFpiYMEzBGakUFm7D8tV7ye1JfBrSC6I/url
a6482ea44033007a9da963cd3ff5ce49hash
013081a63b3561182855875975b849eahash
d616f3989680b040b7f7bbd620a755a1c8f29318hash
202c71cccc63a9bad0c94b898a6447c2723724c7c534bfb7f2143eb6a50a2196hash
31a762fdce1008e635a5e6486d7bc50b4bce671c9232006216e70cd8f2a4a7fbhash
34b80a1b8d157606d8f95929c59eb8844f693613hash
25f47746cfa8e42e3e4368fd52649967ed56e0c9hash
90b2ceb05b34ed6012d20b547cec83a2dacbe56659eb4479150f30015172c3c2hash
21e329ad1a25176e7e17f0215f3fb95e723942e30b0f8eb6b478023dd0a36746hash
f297993a5d419d521cc613fe7c357368b251969chash
148e99089ecbe9cffadddd4f8f0114b2hash
f7f9b71363f3ba30282cf093141164710a991463hash
5cae1bc499bb70c7bd93592360a9d6d5a4fefa3969feecb4c87553ddb582976dhash
478a9a9ebc5993baaa14c360bd1f3a8269b92571abe6613de1f457dd448c76fahash
e51673c5981d94544b0392939ce7c0ac0f31bad427b1ea6ea998634b8e443b3ehash
578a549be9926fbd8016a8ff8ec0636ehash
2b150301ee3c2b37c551fefb4bf2a291db3660achash
3f18c846952902badceaaf870f321598465a785963e098a621d7660aceffdbechash
cd779076639126e20c3a7f2db656f376977953493fa33cc1ac232c4631f19810hash
8ed2be4f406cd7012bbc432229c8938a97f02b5ahash

Another file to check? Run a file hash reputation check.