S0331 - AgentTesla

AgentTesla is a sophisticated and widely-used Remote Access Trojan (RAT) that has been active since 2014. It is a form of malware designed to infiltrate and steal sensitive information from victims' systems, such as login credentials, system information, and other critical data. This Trojan is often delivered through phishing emails with malicious attachments or embedded links.

Author
agomez
Created
2023-03-27 16:09:58
Last updated
2026-02-07 18:52:27
Downloads
412793
IPv4 indicators
8
Hostname indicators
1061
URL indicators
331
Sample indicators
24597

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

a076938fa168d283115525aebeb972f8eba151566a82e06503c23e0d95c4dffa Sample

modified 2026-10-17 11:04:24
Agent Tesla (ThreatFox Abuse.ch)

ftp.darlenemarino.cyou Hostname

modified 2026-10-17 10:45:01
Agent Tesla (ThreatFox Abuse.ch)

http://twizt.net/spml.exe URL

modified 2026-10-17 10:41:01
Malware Download (URLhaus Abuse.ch) · Agent Tesla (ThreatFox Abuse.ch)

https://gfnstuff.pages.dev/GalacticToolsV3.exe URL

modified 2026-10-17 10:37:19
Agent Tesla (ThreatFox Abuse.ch)

alptamaracapital.org Hostname

modified 2026-10-17 10:04:47
Malware Download (URLhaus Abuse.ch) · Agent Tesla (Maltrail)

karakocsystem.xyz Hostname

modified 2026-10-17 08:41:40
Agent Tesla (ThreatFox Abuse.ch)

vncnew1984.duckdns.org Hostname

modified 2026-10-17 08:40:27
Agent Tesla (Maltrail)

newblogheresee.blogspot.com Hostname

modified 2026-10-17 08:40:19
Agent Tesla (Maltrail)

abodiopdate.blogspot.com Hostname

modified 2026-10-17 08:40:19
Agent Tesla (Maltrail)

ftp.sanchezamador.com.mx Hostname

modified 2026-10-17 08:40:19
Agent Tesla (ThreatFox Abuse.ch)

yahameinhunbusorkoinai.blogspot.com Hostname

modified 2026-10-17 08:40:17
Agent Tesla (Maltrail)

mail.efx.net.nz Hostname

modified 2026-10-17 08:40:14
TSPY_NEGASTEAL.SMH (Hybrid-Analysis) · Agent Tesla (Maltrail)

asycoctubre20212021.duckdns.org Hostname

modified 2026-10-17 08:40:14
AsyncRAT (ThreatFox Abuse.ch) · Agent Tesla (Maltrail)

urlpropogationintimitacy.blogspot.com Hostname

modified 2026-10-17 08:40:11
Agent Tesla (Maltrail)

kinkolulu.blogspot.com Hostname

modified 2026-10-17 08:40:04
Agent Tesla (Maltrail)

tumharimaakachodamarunmain.blogspot.com Hostname

modified 2026-10-17 08:40:03
Agent Tesla (Maltrail)

huskidkifklaoksikfkfijsju.blogspot.com Hostname

modified 2026-10-17 08:39:18
Malware Download (URLhaus Abuse.ch) · Agent Tesla (Maltrail)

re-pos.in Hostname

modified 2026-10-17 08:38:58
Agent Tesla (Maltrail)

ankaragucluler.com Hostname

modified 2026-10-17 08:38:35
Agent Tesla (Maltrail) · Top Popularity Site (Cisco Umbrella)

alonso.ydns.eu Hostname

modified 2026-10-17 08:38:28
Agent Tesla (Maltrail)

ftp.skibokshotell.no Hostname

modified 2026-10-17 08:38:14
Agent Tesla (Maltrail)

ekonomski.ba Hostname

modified 2026-10-17 08:37:46
Tesla (Cybercrime-tracker.net) · Agent Tesla (Maltrail)

217d3f277f487b18312d87c2b2b35950b64239c5a3ee1db65a5e46f6c518e871 Sample

modified 2026-10-17 07:38:34
Agenttesla (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

http://futuresbuilder.net/dayafter/uploadimages/newsimages/file/72375245310.pdf URL

modified 2026-10-17 06:36:38
Agent tesla (Maltiverse Threat Observatory)

https://delp-heizungsbau.de/DT9.txt URL

modified 2026-10-17 06:32:47
Malware Download (URLhaus Abuse.ch) · Agent tesla (Maltiverse Threat Observatory)

https://www.mediafire.com/file/6urm5ylq31a3s24/Odeme_makbuzu.7z/file URL

modified 2026-10-17 06:30:21
GuLoader (Maltiverse Research Team) · AgentTesla (Maltiverse Research Team)

static.s123-cdn-static.com Hostname

modified 2026-10-17 05:50:36
Phishing site (Hybrid-Analysis) · Malicious site (Hybrid-Analysis) · Generic.Malware (Hybrid-Analysis) · Top Popularity Site (Cisco Umbrella) · Malware Download (URLhaus Abuse.ch)

otherbusinesssep23.blogspot.com Hostname

modified 2026-10-17 05:30:52
Agent Tesla (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis) · Agent Tesla (Maltrail)

buzalotr.blogspot.com Hostname

modified 2026-10-17 05:30:52
Agent Tesla (ThreatFox Abuse.ch) · Agent Tesla (Maltrail)

ftp.sequences.digital Hostname

modified 2026-10-17 05:30:51
Agent Tesla (ThreatFox Abuse.ch)

ftp.atelierzolotas.gr Hostname

modified 2026-10-17 05:30:50
Agent Tesla (ThreatFox Abuse.ch)

ftp.fundacionpiaz.org Hostname

modified 2026-10-17 04:40:21
Agent Tesla (ThreatFox Abuse.ch)

slucasanderson.ddns.net Hostname

modified 2026-10-17 04:40:19
Nanocore RAT (ThreatFox Abuse.ch) · Agent Tesla (Maltrail)

ftp.untentepc.info Hostname

modified 2026-10-17 04:38:43
Agent Tesla (ThreatFox Abuse.ch)

evrenapi.xyz Hostname

modified 2026-10-17 04:37:47
Agent Tesla (ThreatFox Abuse.ch)

busizinusa.blogspot.com Hostname

modified 2026-10-17 04:37:34
Malware Download (URLhaus Abuse.ch) · Agent Tesla (Maltrail)

swissprint-online.ch Hostname

modified 2026-10-17 04:35:46
Agent Tesla (Maltrail)

hotelmain26march.blogspot.com Hostname

modified 2026-10-17 04:35:13
Agent Tesla (Maltrail)

cawp1.blogspot.com Hostname

modified 2026-10-17 04:35:03
Agent Tesla (Maltrail)

booking-c.blogspot.com Hostname

modified 2026-10-17 04:34:39
Malware Download (URLhaus Abuse.ch) · Agent Tesla (Maltrail)

taxmogalupupitpamobitola.blogspot.com Hostname

modified 2026-10-17 04:34:31
Agent Tesla (Maltrail)

weviio.com Hostname

modified 2026-10-17 04:33:56
Agent Tesla (Maltrail)

sweedoffice-bosskobi.duckdns.org Hostname

modified 2026-10-17 04:33:31
evasive ,trojan (Maltiverse) · Agent Tesla (Maltrail)

72e4eef0ad51dd19875529cd8afc79cc1cc4c134241d7ed7252ab0e27f6e42dc Sample

modified 2026-10-17 02:58:01
Agent Tesla (Triage)

ftp.experthvac.ro Hostname

modified 2026-10-17 00:40:11
Agent Tesla (Maltrail)

p30oopp.blogspot.com Hostname

modified 2026-10-17 00:40:10
Agent Tesla (Maltrail)

ftp.avion.com.sg Hostname

modified 2026-10-17 00:39:49
Agent tesla (Maltiverse Threat Observatory) · Agent Tesla (ThreatFox Abuse.ch)

mail.interflow.com.pk Hostname

modified 2026-10-17 00:39:43
Agent Tesla (Maltrail)

aboudeupdater.blogspot.com Hostname

modified 2026-10-17 00:39:39
Agent Tesla (Maltrail)

ftp.zetrocom.my Hostname

modified 2026-10-17 00:39:26
Agent Tesla (ThreatFox Abuse.ch)

sindevil.com Hostname

modified 2026-10-17 00:39:19
Tesla (Cybercrime-tracker.net) · Agent Tesla (Maltrail)

olodofries.ddns.net Hostname

modified 2026-10-17 00:39:19
AsyncRAT (ThreatFox Abuse.ch) · Agent Tesla (Maltrail)

xzitnoip.duckdns.org Hostname

modified 2026-10-17 00:38:49
Agent Tesla (Maltrail)

thethingsidontheoneday.blogspot.com Hostname

modified 2026-10-17 00:38:29
Agent Tesla (Maltrail)

repoyochar2u.ddns.net Hostname

modified 2026-10-17 00:38:29
bladabindi (Maltiverse) · Gen:Variant.Strictor (Hybrid-Analysis) · Agent Tesla (Maltrail)

htlmain2aprl.blogspot.com Hostname

modified 2026-10-17 00:38:11
Agent Tesla (Maltrail)

booking-coms.blogspot.com Hostname

modified 2026-10-17 00:38:09
Malware Download (URLhaus Abuse.ch) · Agent Tesla (Maltrail)

cleveropame.ydns.eu Hostname

modified 2026-10-17 00:38:08
Agent Tesla (Maltrail)

resutanur.blogspot.com Hostname

modified 2026-10-17 00:36:43
Malware Download (URLhaus Abuse.ch) · Agent Tesla (Maltrail)

idropbux.blogspot.com Hostname

modified 2026-10-17 00:36:28
Agent Tesla (ThreatFox Abuse.ch) · Agent Tesla (Maltrail)

libazo.com Hostname

modified 2026-10-17 00:36:26
Agent Tesla (Maltrail)

thankforeverythingeheheh.blogspot.com Hostname

modified 2026-10-17 00:36:10
Agent Tesla (Maltrail)

tehnomag.rs Hostname

modified 2026-10-17 00:36:03
Agent tesla (Maltiverse Threat Observatory)

machearkalonikahdi.blogspot.com Hostname

modified 2026-10-17 00:35:56
Agent Tesla (Maltrail)

tumharimaakachodamarunmaine.blogspot.com Hostname

modified 2026-10-17 00:35:14
Malicious site (Hybrid-Analysis) · Agent Tesla (Maltrail)

sender.agenttesla.com Hostname

modified 2026-10-17 00:34:34
Agent Tesla (Maltrail)

meriqismathiteknaihai.blogspot.com Hostname

modified 2026-10-17 00:34:23
Agent Tesla (Maltrail)

ftp.vilimorin.com Hostname

modified 2026-10-16 23:37:42
Agent tesla (Maltiverse Threat Observatory) · Agent Tesla (ThreatFox Abuse.ch)

8434cde2bdc2348cfa37e975a6c2175a4ebd7f539967a893a0ccfed07bcd6e7f Sample

modified 2026-10-16 22:59:51
AgentTesla (Cyber Threat Alliance)

https://6e37e838-c278-4d46-baa9-25b8497af200.filesusr.com/ugd/fbcb80_f34379a8aba94ce9ba75382f0889e8f2.pdf URL

modified 2026-10-16 22:36:22
Agent tesla (Maltiverse Threat Observatory)

32a67152aff23610181cdad5ce2f0df8461a35dd8258d7be451f79d10ae22ba9 Sample

modified 2026-10-16 22:13:38
AgentTesla (Cyber Threat Alliance)

titupatiyannala-myrynaal.blogspot.com Hostname

modified 2026-10-16 20:40:44
Agent Tesla (Maltrail)

spencerstuartllc.top Hostname

modified 2026-10-16 20:40:43
Loki Password Stealer (PWS) (ThreatFox Abuse.ch) · Agent Tesla (Maltrail) · Top Popularity Site (Cisco Umbrella)

ftp.gantelopex.com Hostname

modified 2026-10-16 20:40:42
Agent Tesla (ThreatFox Abuse.ch)

ftp.melrz.com Hostname

modified 2026-10-16 20:40:24
Agent Tesla (ThreatFox Abuse.ch)

strongodss.ddns.net Hostname

modified 2026-10-16 20:40:22
Nanocore RAT (ThreatFox Abuse.ch) · Gen:Heur.Variadic.A.304 (Hybrid-Analysis) · Malicious site (Hybrid-Analysis) · Agent Tesla (Maltrail)

kdaoskdokaodkwldld.blogspot.com Hostname

modified 2026-10-16 20:39:36
Agent Tesla (Maltrail)

samhwansleel.com Hostname

modified 2026-10-16 20:39:20
Agent Tesla (Maltrail)

repoyochar2u.hopto.org Hostname

modified 2026-10-16 20:39:04
Agent Tesla (Maltrail)

hotelbackuppowaug.blogspot.com Hostname

modified 2026-10-16 20:38:57
Agent Tesla (Maltrail)

skysky.duckdns.org Hostname

modified 2026-10-16 20:38:42
Nanocore RAT (ThreatFox Abuse.ch) · Generic.Malware (Hybrid-Analysis) · Agent Tesla (Maltrail)

futuresbuilder.net Hostname

modified 2026-10-16 20:38:33
Agent tesla (Maltiverse Threat Observatory) · Exploit.generic (Maltiverse Threat Observatory) · Exploit.minerva (Maltiverse Threat Observatory) · Malicious behavior (Maltiverse Threat Observatory) · Malicious.PDF (Maltiverse Threat Observatory)

kumakahchachi.blogspot.com Hostname

modified 2026-10-16 20:38:17
Malware site (Hybrid-Analysis) · Agent Tesla (Maltrail)

shreeyantraindia.com Hostname

modified 2026-10-16 20:38:07
Malware site (Hybrid-Analysis) · AgentTesla (Mr.Looquer)

sqlserviceazure.blogspot.com Hostname

modified 2026-10-16 20:37:34
Agent Tesla (Maltrail)

ftp.ckzafetyztres.com Hostname

modified 2026-10-16 20:37:25
Agent Tesla (ThreatFox Abuse.ch)

dhuidwyqhdbvjasdhogyatohonathawarnameinmargya.blogspot.com Hostname

modified 2026-10-16 20:36:58
Agent Tesla (Maltrail)

p41wwew.blogspot.com Hostname

modified 2026-10-16 20:36:57
Agent Tesla (Maltrail)

originwealth.ydns.eu Hostname

modified 2026-10-16 20:36:52
Agent Tesla (ThreatFox Abuse.ch) · Top Popularity Site (Cisco Umbrella) · Agent tesla (Maltiverse Threat Observatory)

cbasep23.blogspot.com Hostname

modified 2026-10-16 20:36:26
Agent Tesla (ThreatFox Abuse.ch) · Agent Tesla (Maltrail)

px13.blogspot.com Hostname

modified 2026-10-16 20:35:47
Agent Tesla (Maltrail)

papagunnakjllidmc.blogspot.com Hostname

modified 2026-10-16 20:35:11
Agent Tesla (Maltrail)

greenco2020.top Hostname

modified 2026-10-16 20:34:53
SmokeLoader (ThreatFox Abuse.ch) · Agent Tesla (Maltrail) · Top Popularity Site (Cisco Umbrella) · Malicious behavior (Maltiverse Threat Observatory)

jaffacakes118_eb09540b964774004b5c0cdc670bc59e2166c7d97f2403e373e25d85d8e8186b.bin Sample

modified 2026-10-16 20:14:51
Agent Tesla (Triage)

Purchase Order - PO-2603113056899.JS Sample

modified 2026-10-16 18:45:04
AgentTesla (MalwareBazaar Abuse.ch) · Agent Tesla (Triage) · Generic Malware (Hybrid-Analysis)

152.89.160.131 IPv4

modified 2026-10-16 18:43:57
Ave Maria (ThreatFox Abuse.ch) · Unknown malware (ThreatFox Abuse.ch) · Anonymizer (Maltiverse) · TOR Exit Node (TorProject.org) · HTTP Spammer (StopForumSpam.com)

de3b5120d49b6d5c5180013d14a29515fcd3206dc734a2f25d5aa6e6e6d8a4d4 Sample

modified 2026-10-16 18:14:11
Agent Tesla (Triage)

pushkin231.mooo.com Hostname

modified 2026-10-16 18:01:31
Agent Tesla (Maltrail)

90d795673819d05a59d078296138222dee1991c9f9341f90ebc872201b4f3ba2 Sample

modified 2026-10-16 17:28:10
Agent Tesla (Triage)

tr1.hostgator.com.tr Hostname

modified 2026-10-16 16:40:06
Agent Tesla (Maltrail)