Agent Tesla - Distribution Methods
File types, delivery vectors, and hosting infrastructure used to distribute Agent Tesla.
Last updated: 2026-08-09
Understanding how Agent Tesla reaches victims is critical for prevention. This page breaks down the file types used in distribution, the hosting infrastructure serving malicious payloads, and URLs tracked by URLhaus. Data is updated daily.
What Distribution Data Tells You
Shifts in file type distribution often signal changes in delivery tactics. For example, a move from .exe to .msi files may indicate operators adapting to Windows SmartScreen or email gateway filtering. A surge in .js or .vbs files suggests script-based delivery through phishing emails. Monitoring these patterns helps you tune your email security gateway rules and endpoint protection policies to block the current delivery method before it reaches end users.
Hosting Infrastructure
The hosting data below shows which domains and servers are actively distributing Agent Tesla payloads. Add these to your DNS blocklists, web proxy deny rules, and firewall policies. Hosting infrastructure tends to rotate frequently as takedowns occur, so check this page regularly. All URL data is sourced from URLhaus. For hash-based indicators, see the IOC page. For sample details, see Agent Tesla samples.
File Types (500 samples)
js 285 (57%)
exe 103 (21%)
rar 34 (7%)
zip 15 (3%)
hta 14 (3%)
vbs 11 (2%)
tar 9 (2%)
jse 8 (2%)
xls 5 (1%)
wsf 5 (1%)
ps1 3 (1%)
vbe 2 (0%)
xlsx 2 (0%)
img 2 (0%)
uue 1 (0%)
r01 1 (0%)
Malicious Distribution URLs (164)
https://grupohenry1.com/astillerohenry.com/imgnic_165817.png https://firebasestorage.googleapis.com/v0/b/julyendingapama.firebasestorage.app/o/img_140608.png?alt=media&token=b5bd8e8c-f453-466e-8754-dcbea04e24cc https://grupohenry1.com/astillerohenry.com/nMSI_PRO.png http://45.9.168.230/yuoriginsmtp.png http://192.255.159.254/70/img_202115.png http://192.255.159.254/70/goodthingswithbestsupportforme.hta https://donal.gt.tc/img_035345.png https://sweet-snowflake-8a7e.uploadesclintesss.workers.dev/YjlDQ https://lion44.net/wp-includes/theme-compat/gvewiny/wnfgzub/pzowjyv/MSId_PRO.png https://lion44.net/wp-includes/theme-compat/gvewiny/wnfgzub/pzowjyv/img_152245.png https://lenotecadiarqua.it/eGuqAVa104.bin https://lenotecadiarqua.it/Lbskesl.u32 https://grupohenry1.com/astillerohenry.com/imglt_105404.png https://sweet-snowflake-8a7e.uploadesclintesss.workers.dev/TirIc https://lenotecadiarqua.it/Phyllo.lzh https://pub-45a83f302a1943ed8d62418c2af947ef.r2.dev/kiii.png https://lenotecadiarqua.it/CHvWdTBpYyjtaVvoRehzda105.bin http://104.161.46.87/grace/kaaqgvFm226.bin http://104.161.46.87/grace/bJcUMBU57.bin http://104.161.46.87/grace/PQmuNHPXPNa71.bin http://104.161.46.87/grace/Umoralsk.lzh https://sweet-snowflake-8a7e.uploadesclintesss.workers.dev/plvOa https://pub-3bc1de741f8149f49bdbafa703067f24.r2.dev/hkk.png https://savannahadventureslimited.com/img_005044.png https://sweet-snowflake-8a7e.uploadesclintesss.workers.dev/pzkgG https://pub-3bc1de741f8149f49bdbafa703067f24.r2.dev/juaags.png https://safeuploadz.com/uploads/6a4b9d67c109e.exe https://directdownloadl.ink/f/a7118141be1f.exe https://cosmeticapampa.com.ar/ptk.exe https://pub-45a83f302a1943ed8d62418c2af947ef.r2.dev/jjj.png https://misty-cherry-cea3.uploadsimg.workers.dev/JRVVL https://firebasestorage.googleapis.com/v0/b/dropfile-ff5b9-j0mm4/o/lovethiursdayLincoln.ps1?alt=media&token=b1fba6a1-799d-4b8b-8b14-d48f34e19bba https://firebasestorage.googleapis.com/v0/b/dropfile-ff5b9/o/FRIDAYLincoln.txt?alt=media&token=839d459b-c819-45c5-8748-9e7d70ba4570 https://firebasestorage.googleapis.com/v0/b/june-july-dd5c8-91uk3/o/22mondayLincoln.txt?alt=media&token=ce3b0c87-e670-4b32-940c-675bdc4fc8d2 https://firebasestorage.googleapis.com/v0/b/dropfile-ff5b9-j0mm4/o/day1mondasyLincoln.txt?alt=media&token=975f86e4-4fbf-4963-84df-9d68ea0a1dc3 https://orienttaxtile.com/monday/secured_stub.ps1 https://pub-8fb294ca87ed4b37a3aae4d1de7afa7f.r2.dev/zalionma.png https://firebasestorage.googleapis.com/v0/b/june-july-dd5c8/o/Cytophil.exe?alt=media&token=cb9fe647-a483-4d59-93e6-c044948eb453 https://pdlaw.com.ph/wp-admin/maint/seccured_stub.ps1 http://studiogioeli.it/trichloroflouromethane/Order.js https://magsa.com.pe/sorma/ogfileimg_110519.png https://commercial.great-site.net/img_051220.png http://203.99.148.83/simx.png https://pub-c6a410bb55ff4f0ab8cde9709320b7de.r2.dev/cavolx.png https://specsaversllc.online/mrkelly13/qk3FhjayJfgjjLonmTMtgt9pw6hrKmMImzjw2eqKGsHqMovE.js http://204.44.93.68/img/img_013554.png http://204.44.93.68/20/gooddressingskillgoofforme.hta https://misty-cherry-cea3.uploadsimg.workers.dev/yIPUi https://crypter.howto.rocks/img_045836.png https://pub-3bc1de741f8149f49bdbafa703067f24.r2.dev/yagghasa.png https://pub-3bc1de741f8149f49bdbafa703067f24.r2.dev/hky.png https://ticladevin.ro/robott.ps1 https://pdlaw.com.ph/wp-admin/BALL/stub2.ps1 https://ventaslll.com/admin/MSI_PRO.png http://170.39.215.70/Siames7.ocx http://170.39.215.70/jwnYx38.bin http://170.39.215.70/Phar.pcx https://aair.org.ro/bbUsQZjjwh110.bin https://aair.org.ro/Deor.xsn https://ventaslll.com/admin/lit.png https://web.opendrive.com/api/v1/download/file.json/NF8zMjU5MTMwNDFf?temp_key=%90Xdl%88m%C6&inline=1 https://od.lk/s/NF8zMjU5MTMwNDFf/kFhkbIh.txt https://aair.org.ro/Zoroaster.dwp https://aair.org.ro/Rema.psp https://aair.org.ro/pGsWdCez63.bin https://ventaslll.com/admin/ogfile.png https://ventaslll.com/admin/MSI_PRODJ5TH.png https://brenmayasociados.com/css/DJORIGINNEW.png https://brenmayasociados.com/sass/optimized_foryuJUNE.png https://pub-1900be17f2994b5580d602f23eb7fb93.r2.dev/dgof.png https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/uIfIn https://pub-6f0dab4f7243480ba98591e4c6e339f9.r2.dev/wexokcyu.png https://pub-3eb258fc94fd47cd88d3b4950dd66492.r2.dev/mbgex.png https://brenmayasociados.com/sass/DJorigin.png https://gaiadeqi.com/ogodii.png http://216.9.224.48/3/IpmhdFm.txt https://pub-493b0aca469342c292decf02cdb24f6d.r2.dev/bidiasd.png https://pub-1900be17f2994b5580d602f23eb7fb93.r2.dev/actv.png https://pub-1900be17f2994b5580d602f23eb7fb93.r2.dev/schi.png https://pub-8d59738861b849e5a38b795cc17b1019.r2.dev/saucvvg.png https://ventnor.com.cn/config/stubz.ps1 https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/HjBMU https://pub-3bc1de741f8149f49bdbafa703067f24.r2.dev/aww.png http://23.95.103.214/dreamchaser.png https://s-medicus.si/qwkKpYxIDPlUyDRzCfiY215.bin https://s-medicus.si/demobilis.qxd https://files.catbox.moe/l458qw.ps1 https://miki-visitasia.com/pUpOPRge/A2.ps1 http://172.245.209.253/203/goodthingsarebestbetterwayscomingforu.vbs http://172.245.209.253/203/ech/goodjobtodayreallyfinegoodhearthatcurrentilot.hta https://pub-267b3d8f426d4d9ca10e514a1933f21b.r2.dev/befuzolxv.png https://pub-27c93f4f89e1465b9c1287f8d108b525.r2.dev/dawci87cncfu.png https://remolcares.us/stub.ps1 https://corwineagles.com/payloads.png https://ritubohara.com/stego_payloa.png http://ybhub.com.au/stego_paload.png https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/TdaTm https://pub-f36b05599c3043ddb16520acf6cc3cce.r2.dev/img_174531.png https://raw.githubusercontent.com/BrainiacMonoOS/document/refs/heads/main/origin.exe https://yaso.su/raw/niihmz40
Source: URLhaus (abuse.ch). Updated: 2026-08-09
Hosting Infrastructure
| Host | URLs |
|---|---|
| firebasestorage.googleapis.com | 8 |
| pub-3bc1de741f8149f49bdbafa703067f24.r2.dev | 5 |
| aair.org.ro | 5 |
| 107.173.143.118 | 5 |
| sweet-snowflake-8a7e.uploadesclintesss.workers.dev | 4 |
| lenotecadiarqua.it | 4 |
| 104.161.46.87 | 4 |
| ventaslll.com | 4 |
| 107.175.246.40 | 4 |
| grupohenry1.com | 3 |
| 170.39.215.70 | 3 |
| brenmayasociados.com | 3 |
| pub-1900be17f2994b5580d602f23eb7fb93.r2.dev | 3 |
| icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev | 3 |
| github.com | 3 |
| i.postimg.cc | 3 |
| 209.54.102.132 | 3 |
| casadoserralheirosaocarlos.com.br | 3 |
| wpgbf1zg-5500.euw.devtunnels.ms | 3 |
| 192.3.176.231 | 3 |