Campaigns / Malware / Family

AgentTesla

Agent Tesla is a spyware Trojan written for the .NET framework that has been observed since at least 2014.

19New IOCs · 24h

154New IOCs · 7 days

158Indicators tracked

4Independent feeds

2026-10-12 07:53Last activity

New indicators per day

2026-09-29 to 2026-10-12, by first report.

IP10
Hash144
TLS cert4
C25
Malware153

MITRE ATT&CK lists this as malware Agent Tesla. Explore the ATT&CK matrix →

Where its infrastructure is hosted

🇷🇺 Russia3
🇺🇸 United States2
🇳🇱 Netherlands2
🇬🇧 United Kingdom1
🇰🇭 Cambodia1
🇱🇺 Luxembourg1

Latest indicators

Filter the live feed →

First seen	Type	Indicator	Role	Where
2026-10-12 07:53	IP	91.204.209[.]32:21	Botnet C2	—
2026-10-12 06:17	SHA256	e56dd28592563273910bfaf0d9b05311110c4d9a2fc0656ba5df7c577786c947	Malware sample	—
2026-10-12 05:00	SHA256	02648ef52587c5a221375b1f14ac3e9d554993b234344f47eb6cc09b6da6da78	Malware sample	—
2026-10-12 04:30	SHA256	00e803f257e61ce1eb8ac10ae062bd4508928d2147576e8a23dd2470120d0bc3	Malware sample	—
2026-10-12 04:15	SHA256	9c18dc1fd048efcaf9b55bca4dc8ef4e52e92c10ed2d9d6db3d6cb58c45a7796	Malware sample	—
2026-10-12 04:00	SHA256	00d4a39ec0b06b1951cf5b62e3371b18508c5614fb3c358fe03d3eb9fdcc99ed	Malware sample	—
2026-10-12 04:00	IP	131.253.33[.]200	Contacted by malware	—
2026-10-12 02:30	SHA256	00528c7efad1a5692c87e7fbe7eb1b51792621a38bd28d225c5f6ebabeb8add1	Malware sample	—
2026-10-12 02:02	SHA256	525f9063ee54145e221f4a3f96598120d81c375796ab77ad83e9e363b91c159e	Malware sample	—
2026-10-12 02:02	SHA256	a0d02092a2e6b4b9d6ff1f62b36aa369e7b531a5599d93113f1bb4f9c49586a0	Malware sample	—
2026-10-11 15:18	SHA256	a91b4f52048646d27611074484fc6c5d7b7bbe0742ffa4280901f1ef9dd84170	Malware sample	—
2026-10-11 15:18	SHA256	114776399a71360326ea6ddfa84763efbbe466f697efeb79db77d1e2f3bf6e3f	Malware sample	—
2026-10-11 14:43	SHA256	137dec7260a57a419cd096356a4fdf2a99eca4c0e6b327d586db16ade1fa6f1c	Malware sample	—
2026-10-11 14:43	SHA256	1ffd94ada5294e32d8dc7c37af49cabbd491abd802cfdbf936c5fa34823a1de1	Malware sample	—
2026-10-11 14:43	SHA256	655f2e26c231c3932232df2d132ef2b6dfb9b034a6796a60341bc780dddcc527	Malware sample	—
2026-10-11 14:43	IP	94.103.92[.]101	Contacted by malware	—
2026-10-11 13:36	SHA256	42dfcc2611966da5f16b1208d29f9f057e1d9491b62bb9f3d2840288852a0cf8	Malware sample	—
2026-10-11 13:12	SHA256	49565c6e04fbffadc9138c1203b18a88bf3bf497167df4a5c6a00cf7f5f4188d	payload	—
2026-10-11 13:12	SHA256	78be24965e3c95bcc64de28e51e9ddf7ad91ce920a05a483a8cdf7e1be80294d	payload	—
2026-10-11 08:34	SHA256	4f80ddfe49b270f801ab44aa899153bbe2a0fb93abed0f9fc992f74ff6ab4fde	Malware sample	—
2026-10-11 08:34	SHA256	69b59efaf0e62a569ed967c9424324ce8bce4bd8470290028b1cde177ba2af39	Malware sample	—
2026-10-11 08:09	SHA256	2e62a4997ff297c6c62d4cf929a6f1deaf62ea939d6d90042b0cb08f1129ab2a	Malware sample	—
2026-10-11 07:45	SHA256	3fdbbaaa41af5e314104257bd1d29acb6c620fcfa72677772c494ff2e5f801f8	Malware sample	—
2026-10-11 07:23	SHA256	29df7324ed760f2791764bdea19a32ef700af98c7a5b84f5aa06553a480e7a58	Malware sample	—
2026-10-11 07:12	SHA256	ea9526d87dbfd0900e0e59ea716a484bf1ad2e3bf74f53a514b0999c01bffd29	payload	—
2026-10-11 07:12	SHA256	a8f4cda11f6719a29959b4ec63a398becbe69d0de9694c1dbb19e8dc56a3d0f2	payload	—
2026-10-11 07:12	SHA256	27d212ef95b9a78deea82c9cf8dc4373c5016da466620b4b5c58ab67962b205f	payload	—
2026-10-11 07:02	SHA256	3c41c4443e0f9a23de95868fc0409f6e3fb121fe0a8121ce4539956197634970	Malware sample	—
2026-10-11 07:02	SHA256	40ac9efcf2b146740ea6747a8439b0dfef74fa02e78c00a62f44281575608876	Malware sample	—
2026-10-11 06:41	SHA256	e08d855f695bb61072e806f5ac2c884422c0d747928a836c37233ae008899171	Malware sample	—
2026-10-11 05:59	SHA256	01ef3e0039a51d97f2175d9c3b2d60c983906aabd2bbe05d11bf530bd32de506	Malware sample	—
2026-10-11 05:59	IP	45.15.156[.]3	Contacted by malware	—
2026-10-11 05:18	IP	156.96.47[.]5	Contacted by malware	—
2026-10-11 00:59	SHA256	8bd689cc0510bf3a986a4e668bdf8da8ce11bdc14edddd0441cff703a22341de	Malware sample	—
2026-10-11 00:59	IP	45.119.135[.]167	Contacted by malware	—
2026-10-10 17:46	SHA256	019e852a991caa4bc482fd0af5716370596f81982d0426ffc5378d417f6ddc1d	Malware sample	—
2026-10-10 13:25	IP	107.189.8[.]5	Contacted by malware	—
2026-10-10 12:40	SHA256	69051053098adfffc976b7cdba1649073f57d008b41b80100ecca7e5d96d2937	Malware sample	—
2026-10-10 10:39	SHA256	e365def9269afb1a0a912ab9abb865e372f92ecae4e205fcd197a06d26a2efeb	Malware sample	—
2026-10-09 20:10	SHA256	a56c709e47179c826ada4e91c7d24c0e9f2d020ad756c36d19d43fe0d9333cad	payload	—
2026-10-09 19:06	SHA256	c44d5b7426aeda2fcf3758f456f463bf67cee393d2d0a1fe3be62cb867d2c345	Malware sample	—
2026-10-09 15:45	SHA1	f515654bd03bc3c0636ab9334cc98b14ea81a19c	payload	—
2026-10-09 15:45	MD5	ff398178642634364b05ae413091f831	payload	—
2026-10-09 15:45	SHA256	1f8604584b410ae9b6037d2975d01093832d6b63d454c4b9f40c8f3d1c8b89d5	payload	—
2026-10-09 15:02	SHA256	dc8f4540b0a8ec6a2415085cdfca9bffe3bb653f051e0f62fd6602f14ca3f8f7	Malware sample	—
2026-10-09 15:00	SHA256	903510c99c89320dccdbf6302184d2c0aefc58c4fc95e703ac0e65bdd86eea02	Malware sample	—
2026-10-09 15:00	SHA256	43a49799559079879c83eeabc748787a06630b0e39f9b1745c21edc02f88b6fd	Malware sample	—
2026-10-09 14:58	SHA256	422596cb9741f05f7b35c4d6e5d89335453af13d02effe45aeb96a73ecd63b4d	Malware sample	—
2026-10-09 09:20	SHA256	a56c709e47179c826ada4e91c7d24c0e9f2d020ad756c36d19d43fe0d9333cad	Malware sample	—
2026-10-09 04:02	SHA256	06accce67e5e679bb62ce875a867ba29abed2ac69a146da26c355b2a9374bedb	Malware sample	—
2026-10-09 04:02	SHA256	33dda67e4fb0f6ffff7339dd8f842785e21203a5849f0ecfad6fbe30b1fb15fa	Malware sample	—
2026-10-09 04:02	SHA256	6f54037628daf3e3040ef445e6515dbbaa5d9a4cc9cb2e29c86629bc9fd97ccd	Malware sample	—
2026-10-09 04:02	SHA256	71336214f5dea8316969bd0a0bb11cdae977f6834658b9b31a1fb0523e439d18	Malware sample	—
2026-10-09 04:02	SHA256	8bd1740cd88f48d1244adf0b5833cf5420481b143a1669243829b2830b7db9a3	Malware sample	—
2026-10-09 04:02	SHA256	c30c4c74da8351ad23e8466a314a32243f7c1e82af117a89961eaaecb57b320b	Malware sample	—
2026-10-09 04:02	IP	94.26.249[.]88	Contacted by malware	—
2026-10-09 03:32	SHA256	1d1894f47f06681207956579e64edcea623906e7b9ac53fbbb220e8c70ea2c21	Malware sample	—
2026-10-09 03:32	SHA256	296101bca6b8731381d51eff42506b69683974da915af3400a57c4d85ebca969	Malware sample	—
2026-10-09 03:32	SHA256	62590557664532591c89f70e65e0f7bc8689b3828c2aac9d9747888d0e732f9f	Malware sample	—
2026-10-09 03:17	SHA256	214ead0b8b7b7dba2b9d0be3bd44ce1a6336fd35430533ce7a2cd7f5ade347dd	Malware sample	—
2026-10-09 03:17	SHA256	3bbedec77d1b7a2bda8bef0709c3bdbede890951d4982d57cf3f94e725a2ad53	Malware sample	—
2026-10-09 03:17	SHA256	675382b0dbeb748302841f10cb6a97e0385f0a07fd41ebd3eccc32a6d08c225b	Malware sample	—
2026-10-09 03:17	SHA256	87a73e0f8334d4e0558389446946645c63933568b5cdf3da99ac0dcfc7fe6893	Malware sample	—
2026-10-09 03:17	SHA256	91ea153e0e18dac06edcc686c5f19733fd86b9d1449e6bb70a16039a8da385a4	Malware sample	—
2026-10-09 03:02	SHA256	5b5f420fb61cd4e035d5c4de07f5761c2e15477256ce447bfe1a47b988281c85	Malware sample	—
2026-10-09 02:47	SHA256	0800bf64bd6eecf3bb2b3e2bcd38f4660646625c1349b8d449821a4d0fba07da	Malware sample	—
2026-10-09 02:47	SHA256	64366b9259a594bc3a0def521e1ff3002497b9861ee2c8fe5858f97c0c9d5a9e	Malware sample	—
2026-10-09 02:31	SHA256	84ae4dbdef57689d831923d1858ee1709959555b9e7e239e49d3afb9559bf5bb	Malware sample	—
2026-10-09 02:02	SHA256	aa6ca1da68b711a534cdae77c39382d6f020679a7ea56e1563bae1a3c9342d0f	Malware sample	—
2026-10-08 19:27	SHA256	b217cd0861f5cef33e7b931a68bf113d697f7a9a9ae6562e7d1ce4a799b1eedd	Malware sample	—
2026-10-08 19:26	SHA256	3b4447ca32cd0dd6c8f89ab31500ccb8528e0bd8ae5346000b95d424a0e722d8	Malware sample	—
2026-10-08 18:58	SHA256	75ef0a4659cf2ef74c0ec48dea5443a53085b11a8b481d9bc4a06120a5731d48	Malware sample	—
2026-10-08 18:54	SHA256	1f8604584b410ae9b6037d2975d01093832d6b63d454c4b9f40c8f3d1c8b89d5	Malware sample	—
2026-10-08 18:53	SHA256	27d212ef95b9a78deea82c9cf8dc4373c5016da466620b4b5c58ab67962b205f	Malware sample	—
2026-10-08 18:53	SHA256	a8f4cda11f6719a29959b4ec63a398becbe69d0de9694c1dbb19e8dc56a3d0f2	Malware sample	—
2026-10-08 18:53	SHA256	ea9526d87dbfd0900e0e59ea716a484bf1ad2e3bf74f53a514b0999c01bffd29	Malware sample	—
2026-10-08 18:50	SHA256	7695edc8fa28acba3ec6a1762bf35ee45cd4751ab1d57d9b20f1b98cfcf6bfe9	Malware sample	—
2026-10-08 14:44	SHA256	6a72e332aa318aa94e7fc6de1fc8a54fcfc4c3b1cfb52f09500dc9eda1bbe2db	Malware sample	—
2026-10-08 14:16	SHA256	93a02e28c64549669aaf37b557849b148f2dde48e895c0e6c9c519b8ae517e39	Malware sample	—
2026-10-08 12:27	SHA256	d667fd75ef24f9fafdb3b710e5b30f4307f3c4835f01d9a7cd37731ff57a2b47	Malware sample	—
2026-10-08 12:23	SHA256	49575e2086e0f2b1787fb7a520ec2ccc65d9d0fdcf5388263a2a000829dc950d	Malware sample	—
2026-10-08 11:37	SHA256	fdb96b089600456727a2d47bed940c5454f0ace34c193189b01e2752e73a9c5d	Malware sample	—
2026-10-08 11:12	SHA256	e2dd74688ecaac532b892af9d918755362e5ae63de4bcb80ae38102b6b8ce6cc	Malware sample	—
2026-10-08 09:39	SHA256	ca37ab53b53ba899ea0a41b7d970ee391a6434af064ac4bbeb8e2758dfd14908	Malware sample	—
2026-10-08 09:38	SHA256	1d5b33da82a0e4b6afd2969098d6ec75c4e6d76cf79ab1ef4bb6b3a167b4216a	Malware sample	—
2026-10-08 09:38	SHA256	2be27ea105703cc8a85aa0122b96067b5c1b102782419ec8a45fb779c117eafd	Malware sample	—
2026-10-08 09:38	SHA256	1e8de5200601b70575e9ffdb1470fa6731f7ff26203eb326a899fc45d93b27bf	Malware sample	—
2026-10-08 09:38	SHA256	739801b9ff3f68bf0a56e2d3ee5cba3dce4774c4a54742c937e6f58c356b3616	Malware sample	—
2026-10-08 09:38	SHA256	58387f0953bb2988c7b0d2c0eb8f4254ab22719cdf54e9c4400bb80e7db5abd6	Malware sample	—
2026-10-08 09:37	SHA256	332bf0e4d54fb88c288a96186266ffba4aef8f35ac96ce7739f698af945ada8b	Malware sample	—
2026-10-08 09:37	SHA256	3389f809480535794529136ad3b045e372ed456807570a0aad41bcdc4fa7fec8	Malware sample	—
2026-10-08 09:36	SHA256	2385f35197fd24b0e9e612cbc240094aae802e090033397cdb578470af461d74	Malware sample	—
2026-10-08 09:36	SHA256	5f74281b9f4ed6ee2b8594840e91b487f01845f756e3afca1d1302f1c71c505f	Malware sample	—
2026-10-08 09:35	SHA256	a433fc1100162c2e514315fad6353c431d79312ca687b79f2607f7fb7e23a274	Malware sample	—
2026-10-08 08:56	SHA256	280cc0c5ec0aeddfc2b0dc316045c94773a6809da7f3854f562a10d58d1ca5c8	Malware sample	—
2026-10-08 07:49	SHA256	8d79f9212e3161cf475eebd1890f3fbc98424264b48a613da6bb86dcaba7ed54	Malware sample	—
2026-10-08 07:49	SHA256	fd7af279ae0aab03a3ab62f3a227275e30a92ed87d3684aecd60114e9ffc4b97	Malware sample	—
2026-10-08 05:10	SHA256	f33e396e26ac80037993f9ddba748c1698b1534d6c87ddee8eb91018ccf95344	Malware sample	—
2026-10-08 03:30	SHA256	1d3d43afcc978295f4a4aa60a35927a4061fa37dd1e3f3feffe4fe03e55dd887	Malware sample	—
2026-10-08 02:46	SHA256	266903064bf52747e24a82a006be80fa38cd8673f2efe8b6c95eb7ddf048a814	Malware sample	—

Defanged for safety. URL query strings removed.

New indicators per day

Where its infrastructure is hosted

Latest indicators

Security check