Agent Tesla - Malware Samples
500 samples tracked (rolling 30 days)
Last updated: 2026-08-14
This page lists the most recent Agent Tesla malware samples collected from MalwareBazaar. Each entry includes the SHA256 hash (linked to the MalwareBazaar sample page), original file name, file type, size, and VirusTotal detection rate where available. Samples are updated daily and retained for a rolling 30-day window.
How to Use This Data
Security teams can use these hashes in several ways. Import them into your SIEM or EDR platform to detect known Agent Tesla variants in your environment. Cross-reference file names against your email gateway logs to identify phishing campaigns delivering this family. The file type distribution reveals which delivery formats are currently in use - a shift from .exe to .msi or .js may indicate the operators are adapting to your defenses. Samples with low or missing VirusTotal detection rates are the most dangerous - these are fresh variants that may bypass signature-based protection.
About the Data
All samples are sourced from MalwareBazaar, a free malware sample sharing platform operated by abuse.ch. Detection rates come from VirusTotal. This data is provided for defensive purposes only. For the latest Agent Tesla indicators of compromise including C2 servers and domains, see the IOC page.
| SHA256 | File Name | Type | Size | Detection | First Seen | Country |
|---|---|---|---|---|---|---|
| 2cdd19401871a2df... | Payment receipt.js | js | 1.1 MB | 4/56 | 2026-08-14 | - |
| 63372977dbcb495d... | Document_pdf.js | js | 2.2 MB | 12/59 | 2026-08-14 | - |
| 0e0bca2b782fb3d9... | Paymeanto14082600008976.exe | exe | 258.1 KB | 29/69 | 2026-08-14 | - |
| 1dec99fe32389748... | SecuriteInfo.com.X97M.DownLoader.2343.18979.14492 | xlsx | 734.5 KB | 12/61 | 2026-08-14 | - |
| 87f546a44fedc786... | Scan_Document_HSBC_Payment_Copy.cmd | cmd | 1.3 MB | 11/59 | 2026-08-14 | - |
| 9164e4923252fe49... | WCA_Requerimiento_de_Productos.xla | xlsx | 28.0 KB | 33/61 | 2026-08-14 | - |
| 842ee9e81e745696... | weneedbestthingsfromtheheartforbest.js | js | 3.2 MB | 16/60 | 2026-08-13 | - |
| 8be3c11db8dee6e6... | Invoice INV-0089573.PDF.JS | js | 3.2 MB | 16/60 | 2026-08-13 | - |
| 6daf312ae0864267... | PO No. PO-KE-2026-0841.JS | js | 3.2 MB | 14/60 | 2026-08-13 | - |
| 4aac943dcb338f2a... | Payment Invoices.pdf.JS | js | 2.9 MB | 29/60 | 2026-08-13 | - |
| 1f3c811e542fc56d... | givingbesthingsforbetterforme.hta | hta | 14.6 KB | - | 2026-08-13 | - |
| afb37dc0678f295b... | FACTURA.js | js | 2.1 MB | - | 2026-08-13 | - |
| 1ca2ff1db58586f3... | transferencia-98758.000023.js | js | 19.0 MB | - | 2026-08-13 | - |
| 52a84a4a59e7b2e0... | PI INVOICE.JS | js | 3.2 MB | - | 2026-08-13 | - |
| 443aa230e5e09970... | Purchase_Order_PH01_PO000065639 .xlam | xlsx | 712.1 KB | - | 2026-08-13 | - |
| 73eea075e06413f6... | Document_pdf.vbe | vbe | 56.0 KB | - | 2026-08-13 | - |
| 9551d8577c3653ac... | NUOVOORD.BAT | exe | 842.4 KB | - | 2026-08-13 | - |
| e0e9e2fff6e00cfb... | Half-NewOrder130826PO1155.exe | exe | 848.7 KB | - | 2026-08-13 | - |
| a8f82c5a5ad3d41b... | RFQ AUG12 2026.JS | js | 3.2 MB | - | 2026-08-13 | - |
| 2e76a50f38c136fb... | 2e76a50f38c136fba5f74d91e141869bf8cc926af5d416c3bf47cad884110f8d.exe | exe | 239.5 KB | - | 2026-08-12 | - |
| 21d5a0a7ca1686d4... | Purchase Order - PO-2603113056899.JS | js | 3.2 MB | - | 2026-08-12 | - |
| 187cccb9071b2cc2... | PO 01404 August-PDF.vbs | vbs | 18.0 KB | - | 2026-08-12 | - |
| 39bd7e65ee9262c6... | Order-10045_2026-08-12.vbs | vbs | 17.8 KB | - | 2026-08-12 | - |
| ae674065b6777e8c... | Terms and Conditions.JS | js | 3.2 MB | - | 2026-08-12 | - |
| ae681a8ca6270248... | transferencia-98758.00002.js | js | 17.1 MB | - | 2026-08-12 | - |
| c83e87ea829d0052... | Purchase_order.JS | js | 3.2 MB | - | 2026-08-12 | - |
| 170a3b6c18e1e797... | INV 83467_12899.JS | js | 3.2 MB | - | 2026-08-12 | - |
| c3aa1d3ffe66344c... | 12 AUG 2026 REQUEST ESD.JS | js | 3.2 MB | - | 2026-08-12 | - |
| 9b13a1e4bd7a99c7... | Evalaute_FQ_6435_STXF_0581 SC23C01KB015_REV.JS | js | 3.2 MB | - | 2026-08-12 | - |
| be7118a60741e093... | VESSEL PARTICULARS.js | js | 2.0 MB | - | 2026-08-12 | - |
| d2d45f990ec79701... | RFQ 00081126.JS | js | 3.2 MB | - | 2026-08-12 | - |
| cd80f4c36a395ae6... | Purchase Order - BHPO26-2790 pdf.JS | js | 3.2 MB | - | 2026-08-12 | - |
| a58cde622c04af01... | Request for Quote _26-RFQ.JS | js | 3.2 MB | - | 2026-08-12 | - |
| ec5a1dc0d9ae6c53... | ΚΑΤΑΣΤΑΣΗ ΛΟΓΑΡΙΑΣΜΟΥ 575844.js | js | 17.1 MB | - | 2026-08-12 | - |
| e598acb2e6227551... | Commercial_Quotation_Request_2026_PO-05909.JS | js | 3.2 MB | - | 2026-08-12 | - |
| bbce8175dc57fa73... | RFQ58206.JS | js | 3.2 MB | - | 2026-08-12 | - |
| 58daf37444ec3b78... | Statement Cargomind 2026-07-31.JS | js | 3.1 MB | - | 2026-08-12 | - |
| ff6fd5e3494dc160... | yamfloor.hta | hta | 1.0 MB | - | 2026-08-12 | - |
| 6c9aca8232da6884... | VAI 114766_260811 Rev01.vbs | vbs | 17.4 KB | - | 2026-08-12 | - |
| bf6eb18ad8b1f477... | JUL SOA 15,340.61 usd - 25008S 06WLUS1NC CMAU3178562.JS | js | 3.2 MB | - | 2026-08-12 | - |
| a3d2ca93fa43d585... | Dringende Angebotsanfrage GmbH 002361192 doc.js | js | 1.1 MB | - | 2026-08-12 | - |
| a736896efc10ad2d... | comprobante de pago.js | js | 1004.8 KB | - | 2026-08-11 | - |
| cf0a2c99a4e18fb0... | PO-000133428.js | js | 1.1 MB | - | 2026-08-11 | - |
| 30c2a3fb1fc0672f... | Orden de compra.js | js | 966.1 KB | - | 2026-08-11 | - |
| 58f4daa5f56a53d4... | oc-9786756456879875.xla | xlsx | 28.0 KB | - | 2026-08-11 | - |
| a0e4e47b1aca6c4d... | PRE ALERT DOCS AND MANIFEST.zip | zip | 1.4 MB | - | 2026-08-11 | - |
| 32c0e2d4c15d7af5... | RFQ.JS | js | 2.9 MB | - | 2026-08-11 | - |
| 0846638011c26f1a... | PO.JS | js | 2.9 MB | - | 2026-08-11 | - |
| c4b48e6278cdca79... | RFQ-JTSA 15938.JS | js | 2.9 MB | - | 2026-08-11 | - |
| 8e6c4413e352fa11... | JUSTIFICANTE.JS | js | 2.9 MB | - | 2026-08-11 | - |
| 26a6bcb49c3cdc40... | DHL_SHIPMENTS_NOTIFICATION_9952312_PDF.JS | js | 2.9 MB | - | 2026-08-11 | - |
| 39ac2c4015532e8b... | goodthingswithbestwayforbetterplacescomingforme.hta | hta | 1023.9 KB | - | 2026-08-11 | - |
| 4180269c675c26e8... | 4180269c675c26e85d20a22f06587a5a45e6f4af5ee4a60fb73dc51317ce50e7.exe | exe | 234.5 KB | - | 2026-08-11 | - |
| cfe18989af6b6465... | Request for Quote _26-RFQ-27926.JS | js | 2.9 MB | - | 2026-08-11 | - |
| fa7d31402f065f56... | Invoice Payment.vbs | vbs | 42.4 KB | - | 2026-08-11 | - |
| 9e567884cc3a602a... | orden-89798.xla | xlsx | 28.0 KB | - | 2026-08-11 | - |
| 630fef4a1f9ec20e... | offlinejsiii.js | js | 4.1 MB | - | 2026-08-11 | - |
| a855977bf7e8b559... | Nueva orden de compra.JS | js | 3.4 MB | - | 2026-08-11 | - |
| 1f482d15d435fb1e... | PO25001898.js | js | 958.9 KB | - | 2026-08-11 | - |
| a4406c6b7b8bbed1... | Ödeme belgesi.js | js | 1.9 MB | - | 2026-08-11 | - |
| 02fd5ba967b9ff94... | CARGO DETAILS.js | js | 1.9 MB | - | 2026-08-11 | - |
| 7e545f358c462113... | PO.JS | js | 3.5 MB | - | 2026-08-11 | - |
| c6953711d8eb67ae... | transferencia-98758.000008887.js | js | 16.2 MB | - | 2026-08-11 | - |
| fe45e6bca6a874ed... | comprobante de pago.js | js | 998.2 KB | - | 2026-08-11 | - |
| 5792ed01fc6edfbc... | Swift.18 000,00.JS | js | 2.9 MB | - | 2026-08-11 | - |
| 520259db65bb3fed... | PS-PO0726-8406.vbs | vbs | 41.9 KB | - | 2026-08-11 | - |
| 55be9d1e2a4edeed... | PO_1000023766A0_1000023763A0.vbs | vbs | 318.6 KB | - | 2026-08-11 | - |
| 07801c260e6c96b2... | RFQ 6000149727.pdf.vbe | vbe | 58.4 KB | - | 2026-08-11 | - |
| 4fc06941e07dbff9... | Purchase_Order_PO111_125895.xlam | xlsx | 635.9 KB | - | 2026-08-11 | - |
| 0f51c133d05ca40f... | orden de compra.js | js | 1.0 MB | - | 2026-08-11 | - |
| 4c1c31b13205ba0a... | 4c1c31b13205ba0a39b7aa9949fab60a863cc9e54d13223a3b25d4a5b06d8140 | exe | 382.7 KB | - | 2026-08-10 | - |
| 907dd5d4c793cf67... | 907dd5d4c793cf6774a8f6638574b35ba6e6c9b10db51434eb5f60e4cee237df | exe | 1.0 MB | - | 2026-08-10 | - |
| 96bc0795b6b630c8... | 96bc0795b6b630c8079d53feb88a0331e89b27747fcf7ed464c672b36d8e1354 | exe | 1017.5 KB | - | 2026-08-10 | - |
| 71ab6ac53c0af815... | 71ab6ac53c0af815f043a04b31d779964acbe64c4a79cc0309ae8c8840c1a7c9 | exe | 1.1 MB | - | 2026-08-10 | - |
| 476e56de551b76b2... | 476e56de551b76b2d631e0b91a9714bbb1e304a5a8c81bf85e97a47b38c91e82 | exe | 339.8 KB | - | 2026-08-10 | - |
| 9cb3d7c4b9f44b58... | 9cb3d7c4b9f44b587f216692e29dba2101f72d315def405eb1291383d6629855 | exe | 936.5 KB | - | 2026-08-10 | - |
| 629fb8f53a18bd7c... | 629fb8f53a18bd7ce5d16d3bb22f97e41d21301b25d58a7e505f8fc1ca55c907 | exe | 1003.0 KB | - | 2026-08-10 | - |
| b615eab43788b8f2... | b615eab43788b8f293b05d046d745fd02a3c18c5c34b9e6a509f188e4c50e17d | exe | 1.7 MB | - | 2026-08-10 | - |
| ada33b7d759984eb... | ada33b7d759984eb9e1c1ac741f7e97396f100e77ec891270ac5954cda59e356 | exe | 1.7 MB | - | 2026-08-10 | - |
| ebcf6abf9c9aaca0... | ebcf6abf9c9aaca0f8ed77276cb8853107ee4d67f7ebf30e321d58190b66f1c1 | exe | 1.2 MB | - | 2026-08-10 | - |
| 7cde3939faf4f245... | 7cde3939faf4f2455e3423203e86e869764d39e78140e52b7acaf36ce4aed513 | exe | 1.0 MB | - | 2026-08-10 | - |
| b295cc8e02baac01... | b295cc8e02baac018ca0b87232e908f4793b0bbb452d15e8370fa26a95f4add3 | exe | 1.2 MB | - | 2026-08-10 | - |
| 218c261e5117a144... | 218c261e5117a1448c12d6ba65c935480d34debbf1fc9ae0041fd237c5a3a1ab | exe | 1.0 MB | - | 2026-08-10 | - |
| dfb247897c1ba7be... | dfb247897c1ba7bed13c7993bfdb60dd49aea33c5e724db556b2991863b3969d | exe | 1.0 MB | - | 2026-08-10 | - |
| 33c6c3f66da3cc8b... | 33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6 | exe | 343.3 KB | - | 2026-08-10 | - |
| af2f9637149ae770... | af2f9637149ae7702d83a35ca1768f753bf46e5dd6902e547bd76f96b1446a7c | exe | 995.0 KB | - | 2026-08-10 | - |
| 6068dcaebde7c4ac... | 6068dcaebde7c4acdc37d90fdd8b513d08c294e8608e1938c13039380f5c136f | exe | 1.1 MB | - | 2026-08-10 | - |
| 63aa8d418861ddd8... | 63aa8d418861ddd8922cc8bd25e808ef7b251f35f2605cfd64ba0d2efdb6b0dc | exe | 1.0 MB | - | 2026-08-10 | - |
| 9b2e17315099fd4f... | 9b2e17315099fd4f4442500c739242b54f4ab424f809173b9a1bf84de0d28ba6 | exe | 1.0 MB | - | 2026-08-10 | - |
| 3aa519838c38d7b0... | 3aa519838c38d7b056b5cc2da23cd0dc26883b8100414b09942af1885a1aa57c | exe | 994.5 KB | - | 2026-08-10 | - |
| 018deb8ea5ecec50... | 018deb8ea5ecec507e0261f58ec3dde7843f85c316fecbd26b9eac8e336ac727 | exe | 1002.5 KB | - | 2026-08-10 | - |
| a0b8d0c6f8478a80... | a0b8d0c6f8478a8082dead050ea904f40f6b7b5149a908a473af6f2ca6572689 | exe | 1.2 MB | - | 2026-08-10 | - |
| 5069364f9e57856f... | 5069364f9e57856f2964c98fabfc09391f604c2a8a0136b2e486896b1d02e9b7 | exe | 1015.5 KB | - | 2026-08-10 | - |
| c21f6749bca94dcd... | c21f6749bca94dcdb0c7c83b759e5f5a93861dff4f6d76ebace099d91a69579f | exe | 1.3 MB | - | 2026-08-10 | - |
| 6f33c793d1bb7673... | 6f33c793d1bb7673c300e9b87f7ffca6d17885ab3f92c5958f84e75faf1e884b | exe | 247.9 KB | - | 2026-08-10 | - |
| 7f3c03d419eba8e6... | 7f3c03d419eba8e6dcacd203e3285496cd13ef5f26a88e6d744c16324c6d4307 | exe | 466.5 KB | - | 2026-08-10 | - |
| 8db72555c4fc52ae... | 8db72555c4fc52ae7a756ab9868af1e372e06e3ad07ed1b80a06e0f5351f28e6 | exe | 269.3 KB | - | 2026-08-10 | - |
| 2cc6c00766b50175... | 2cc6c00766b50175445fd0878e922a3ae4b6cd4e7187ea985ea6b096ac086ba0 | exe | 1.0 MB | - | 2026-08-10 | - |
| 54c1cbb6ad3d27f0... | 54c1cbb6ad3d27f0987613748ad4d4778288bc812445b51e7af0771db17a4a20 | exe | 1.0 MB | - | 2026-08-10 | - |
| 052e4076783100b7... | 052e4076783100b7f0ade5caa592a2d94f23097d3bf959bd353d83a8da327536 | exe | 1012.0 KB | - | 2026-08-10 | - |