Agent Tesla - Distribution Methods
File types, delivery vectors, and hosting infrastructure used to distribute Agent Tesla.
Last updated: 2026-10-04
Understanding how Agent Tesla reaches victims is critical for prevention. This page breaks down the file types used in distribution, the hosting infrastructure serving malicious payloads, and URLs tracked by URLhaus. Data is updated daily.
What Distribution Data Tells You
Shifts in file type distribution often signal changes in delivery tactics. For example, a move from .exe to .msi files may indicate operators adapting to Windows SmartScreen or email gateway filtering. A surge in .js or .vbs files suggests script-based delivery through phishing emails. Monitoring these patterns helps you tune your email security gateway rules and endpoint protection policies to block the current delivery method before it reaches end users.
Hosting Infrastructure
The hosting data below shows which domains and servers are actively distributing Agent Tesla payloads. Add these to your DNS blocklists, web proxy deny rules, and firewall policies. Hosting infrastructure tends to rotate frequently as takedowns occur, so check this page regularly. All URL data is sourced from URLhaus. For hash-based indicators, see the IOC page. For sample details, see Agent Tesla samples.
File Types (500 samples)
js 296 (59%)
exe 102 (20%)
rar 30 (6%)
vbs 17 (3%)
xlsx 10 (2%)
hta 10 (2%)
zip 8 (2%)
jse 7 (1%)
wsf 4 (1%)
ps1 3 (1%)
vbe 3 (1%)
xls 3 (1%)
tar 2 (0%)
msi 1 (0%)
bat 1 (0%)
7z 1 (0%)
cmd 1 (0%)
uue 1 (0%)
Malicious Distribution URLs (200)
https://pub-fcf9a4a0a9f54d8b8240c682f65e12f9.r2.dev/tropvast.vbs https://pub-a327f9d03def4b07b51dba5303fc3620.r2.dev/ojubam.png http://urbanpro.mycpanel.rs/Ringeklokkes.aaf http://urbanpro.mycpanel.rs/ucPNX9.bin https://activegrp.co.za/img_095713.png https://activegrp.co.za/img_075144.png https://pub-f9f2f77b53d14531ba49bd6d0bd18740.r2.dev/mianxer.png http://151.241.154.207/HOST/Crypted.ps1 https://rough-truth-e072.publicftpresend.workers.dev/ztpreeccl https://pub-b98155d31c7b46ecbdf79eab5e37bae3.r2.dev/tanmxsw.png https://adcentral.com.mx/administrator/ognltimg_051814.png https://pub-ce02802067934e0eb072f69bf6427bf6.r2.dev/bin.png https://rough-truth-e072.publicftpresend.workers.dev/mjnij http://185.29.10.35/NyDWxZomGF227.bin https://firebasestorage.googleapis.com/v0/b/julyendingapama.firebasestorage.app/o/slim.png?alt=media&token=c28e3a19-7fb3-443a-88fb-2e3b8a77b454 https://pub-0216fa08b2b94e129cb9e002cf7cb1f4.r2.dev/img_023948.png http://tripfarely.com/crop/5.jpg http://207.180.58.136/5.jpg http://216.9.224.48/90/mckaApc.txt https://firebasestorage.googleapis.com/v0/b/julyendingapama.firebasestorage.app/o/img_092159.png?alt=media&token=930852e2-f86f-4478-8b58-ec8f3ab5c5e5 https://pub-72295f71e45d431995028c79cf261dae.r2.dev/tyjtyujtyuj.png https://pub-c6d653e19fd545129fdfd7d6f8cd8b17.r2.dev/fyhty.hta https://pub-72295f71e45d431995028c79cf261dae.r2.dev/dfghrth.png https://pub-7390aebc53504408b09c0dc5390d6cc4.r2.dev/gusto.png https://pub-82f13abd468442119ddfb068e9f5ad33.r2.dev/stillurboy.hta https://pub-7390aebc53504408b09c0dc5390d6cc4.r2.dev/toomuchflush.png https://lively-fog-af49.pablosoftwareplus.workers.dev/tfDyw https://long-wildflower-b4f5.gustavosoftware.workers.dev/KNikZ https://pub-80a0cc6d7e3d475dac1422cf49122362.r2.dev/mianxer.png http://epsinf.com/yom/app/centos/4.jpg http://blueoceanealtd.co.ke/our-expertise/4.jpg https://pub-cbeeb81b1c2d40df823a412f702451a3.r2.dev/rdklxci.png https://pub-17ab5f90ca394fc2a98a106eb938ff35.r2.dev/ghecvjk.png https://lively-fog-af49.pablosoftwareplus.workers.dev/ZECCR https://pub-2731c5c84ec94bb78b02c025b7b3f6c4.r2.dev/vtoladyh.png https://pub-cbeeb81b1c2d40df823a412f702451a3.r2.dev/tanmxsw.png https://sportssurgeon.org.pk/Cnidoblast.pcz https://sportssurgeon.org.pk/rVVVuiivzw223.bin https://pub-d56457612c0b43ebbaf5c25537f2fb18.r2.dev/hdenga.png https://pub-1614932a526c40d79fe5bf23e71e3ff7.r2.dev/hcxael.png https://munihuacho.gob.pe//sifyWeb/MSI_PRO.png https://raw.githubusercontent.com/vito674/coco/refs/heads/main/hienoId.txt https://pub-ce4d5a76d41f4db48601a0a54208636e.r2.dev/bdduokd.iso https://munihuacho.gob.pe//sifyWeb/niceimg_092217.png https://munihuacho.gob.pe//sifyWeb/masaimg_094757.png https://pub-ac263311e26f4866accaf2881f4fcc45.r2.dev/bssdyoldc.png https://munihuacho.gob.pe//sifyWeb/xwlitimg_173602.png https://munihuacho.gob.pe//sifyWeb/orginlightimg_051814.png https://firebasestorage.googleapis.com/v0/b/julyendingapama.firebasestorage.app/o/inve%20new.png?alt=media&token=15e2a054-9211-4b2f-987c-c1225adf4faa https://fiscalizarais.xyz/stego_qngpc3hmcp.png https://pub-8f07b712b50246eca5982f64bd695eea.r2.dev/bxaigui.png https://pub-153d2a9e026942c4aff3b3aca8f80952.r2.dev/vceolaqcvj.png https://sunix-technology.com/images/niceorgimg_082205.png https://pub-1c4ef2a315ec4b89b9dfad9472afee69.r2.dev/zuyoking.png https://pub-eab9eb7761644f51bceeecfefdf0ec2b.r2.dev/teddywon.hta https://pub-1c4ef2a315ec4b89b9dfad9472afee69.r2.dev/radman.png http://209.54.103.153/50/givingbesthingsforbetterforme.hta http://204.77.9.56/30/wegivingbestsolutionforbestthings.hta http://204.77.9.56/img/img_081951.png https://pub-8ce03602555a436b80dbe377ce6f81de.r2.dev/bagcorn.png https://pub-7bb797b9d5664a109b755165099495ac.r2.dev/aphelope.hta https://pub-8ce03602555a436b80dbe377ce6f81de.r2.dev/drumwork.png http://209.54.103.153/50/weneedbestthingsfromtheheartforbest.js https://stratagemzw.com/img_014220.png https://www.stratagemzw.com/MSI_PRO.png https://munihuacho.gob.pe/vehiculos/MSI_PRO.png https://munihuacho.gob.pe/vehiculos/img_065018.png https://frtkvnpa.xyz/crypted.ps1 https://flooriscoveringworld.com/BOBBIN.exe https://firebasestorage.googleapis.com/v0/b/julyendingapama.firebasestorage.app/o/invergrace.png?alt=media&token=54ae32e9-1f20-404f-80a5-8fcc841a3c2b http://185.29.10.11/vekselvises.asd http://185.29.10.11/kLcvzhpr18.bin http://185.29.10.11/ePSDxHP52.bin http://185.29.10.11/Menneskevrdige.csv http://107.172.172.254/img/img_041741.png https://plain-wnam-prod-public.komododecks.com/202608/11/xi178dBQGEDOqhKHXtuO/image.png http://107.172.172.254/25/weneedtogetbestthingswithbetterplacesforme.hta https://pub-988fedd2621d406591dbb4e9358bc901.r2.dev/bookwin.png https://pub-ebd75badb3504e77aa1924be8dbce949.r2.dev/yamfloor.hta https://pub-988fedd2621d406591dbb4e9358bc901.r2.dev/mostdon.png https://verdiva.life/admin/MSI_PRO.png http://107.172.172.254/img/img_050827.png http://107.172.172.254/22/goodthingswithbestwayforbetterplacescomingforme.hta https://suavasua.vn/wp-includes/Text/fxuqicg/qvbudog/bstwneo/vv/cryptted.ps1 http://wp.ameyiando.com:8888/web/office365com.dat http://185.29.9.108/nVgXuGSv49.bin http://185.29.9.108/HcesVRijHtJscyGevVVH35.bin http://185.29.9.108/Mistakeful.pfb https://duct-master.com/00/newMSI_PRO.png http://185.29.9.108/Virginalling.asi http://185.29.9.108/gchLdNMan179.bin https://grupohenry1.com/astillerohenry.com/imgnic_165817.png https://firebasestorage.googleapis.com/v0/b/julyendingapama.firebasestorage.app/o/img_140608.png?alt=media&token=b5bd8e8c-f453-466e-8754-dcbea04e24cc https://grupohenry1.com/astillerohenry.com/nMSI_PRO.png http://45.9.168.230/yuoriginsmtp.png http://192.255.159.254/70/img_202115.png http://192.255.159.254/70/goodthingswithbestsupportforme.hta https://donal.gt.tc/img_035345.png https://sweet-snowflake-8a7e.uploadesclintesss.workers.dev/YjlDQ https://lion44.net/wp-includes/theme-compat/gvewiny/wnfgzub/pzowjyv/MSId_PRO.png
Source: URLhaus (abuse.ch). Updated: 2026-10-04
Hosting Infrastructure
| Host | URLs |
|---|---|
| firebasestorage.googleapis.com | 10 |
| munihuacho.gob.pe | 7 |
| 185.29.9.108 | 5 |
| pub-3bc1de741f8149f49bdbafa703067f24.r2.dev | 5 |
| aair.org.ro | 5 |
| 185.29.10.11 | 4 |
| 107.172.172.254 | 4 |
| sweet-snowflake-8a7e.uploadesclintesss.workers.dev | 4 |
| lenotecadiarqua.it | 4 |
| 104.161.46.87 | 4 |
| ventaslll.com | 4 |
| raw.githubusercontent.com | 3 |
| grupohenry1.com | 3 |
| 170.39.215.70 | 3 |
| brenmayasociados.com | 3 |
| pub-1900be17f2994b5580d602f23eb7fb93.r2.dev | 3 |
| icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev | 3 |
| github.com | 3 |
| urbanpro.mycpanel.rs | 2 |
| activegrp.co.za | 2 |