Agent Tesla - Malware Samples
500 samples tracked (rolling 30 days)
Last updated: 2026-10-09
This page lists the most recent Agent Tesla malware samples collected from MalwareBazaar. Each entry includes the SHA256 hash (linked to the MalwareBazaar sample page), original file name, file type, size, and VirusTotal detection rate where available. Samples are updated daily and retained for a rolling 30-day window.
How to Use This Data
Security teams can use these hashes in several ways. Import them into your SIEM or EDR platform to detect known Agent Tesla variants in your environment. Cross-reference file names against your email gateway logs to identify phishing campaigns delivering this family. The file type distribution reveals which delivery formats are currently in use - a shift from .exe to .msi or .js may indicate the operators are adapting to your defenses. Samples with low or missing VirusTotal detection rates are the most dangerous - these are fresh variants that may bypass signature-based protection.
About the Data
All samples are sourced from MalwareBazaar, a free malware sample sharing platform operated by abuse.ch. Detection rates come from VirusTotal. This data is provided for defensive purposes only. For the latest Agent Tesla indicators of compromise including C2 servers and domains, see the IOC page.
| SHA256 | File Name | Type | Size | Detection | First Seen | Country |
|---|---|---|---|---|---|---|
| c44d5b7426aeda2f... | Curriculum Vitae.JS | js | 3.1 MB | 20/60 | 2026-10-09 | - |
| 903510c99c89320d... | SCANDOC109.js | js | 387.8 KB | 21/61 | 2026-10-09 | - |
| 43a4979955907987... | LX_Yc5yyOrIP0.js | js | 363.7 KB | 22/61 | 2026-10-09 | - |
| 422596cb9741f05f... | Ordini_fornitori_pdf.js | js | 560.2 KB | 20/61 | 2026-10-09 | - |
| a56c709e47179c82... | stein.ps1 | ps1 | 1.0 MB | 20/62 | 2026-10-09 | - |
| b217cd0861f5cef3... | Purchase Order QTY #6413620780.js | js | 37.3 KB | 29/61 | 2026-10-08 | - |
| 3b4447ca32cd0dd6... | Curriculum Vitae.JS | js | 3.1 MB | 27/61 | 2026-10-08 | - |
| 75ef0a4659cf2ef7... | stein.ps1 | ps1 | 1.0 MB | 28/60 | 2026-10-08 | - |
| 1f8604584b410ae9... | file.exe | exe | 247.5 KB | 41/67 | 2026-10-08 | - |
| 27d212ef95b9a78d... | geen.ps1 | ps1 | 1.0 MB | 25/60 | 2026-10-08 | - |
| a8f4cda11f6719a2... | GG.ps1 | ps1 | 1016.4 KB | - | 2026-10-08 | - |
| ea9526d87dbfd090... | SS.ps1 | ps1 | 1016.4 KB | - | 2026-10-08 | - |
| 7695edc8fa28acba... | stein.ps1 | ps1 | 1.0 MB | - | 2026-10-08 | - |
| 93a02e28c6454966... | NEW ORDER.js | js | 688.8 KB | - | 2026-10-08 | - |
| 49575e2086e0f2b1... | Gemini Order No.206378105.hta | hta | 693.4 KB | - | 2026-10-08 | - |
| ca37ab53b53ba899... | Customer Inquiry – China RFQ.pdf.js | js | 30.4 KB | - | 2026-10-08 | - |
| 1d5b33da82a0e4b6... | RFQ - EC0000129.JS | js | 3.6 MB | - | 2026-10-08 | - |
| 2be27ea105703cc8... | ThaiHC00202608102026.JS | js | 3.6 MB | - | 2026-10-08 | - |
| 1e8de5200601b705... | ADVANCE PAYMENT.JS | js | 3.6 MB | - | 2026-10-08 | - |
| 739801b9ff3f68bf... | ulqqmyke.JS | js | 3.6 MB | - | 2026-10-08 | - |
| 58387f0953bb2988... | NEW ORDER 21654.js | js | 691.8 KB | - | 2026-10-08 | - |
| 332bf0e4d54fb88c... | REVISED PO# No. 202-1287.pdf.JS | js | 3.6 MB | - | 2026-10-08 | - |
| 3389f80948053579... | shiping new order.JS | js | 3.6 MB | - | 2026-10-08 | - |
| 2385f35197fd24b0... | SOA SEPTEMBER 2026.JS | js | 3.6 MB | - | 2026-10-08 | - |
| 5f74281b9f4ed6ee... | Project_Documents_pdf.js | js | 534.4 KB | - | 2026-10-08 | - |
| a433fc1100162c2e... | OCTOBER ORDER.js | js | 688.2 KB | - | 2026-10-08 | - |
| 280cc0c5ec0aeddf... | SWIFT_109,000USD_pdf.js | js | 52.1 KB | - | 2026-10-08 | - |
| 6ccc3ab2d841beb5... | NEW PO 20416875.js | js | 688.4 KB | - | 2026-10-07 | - |
| 0f1ae5029f2e2864... | Factura_pdf.js | js | 3.3 MB | - | 2026-10-07 | - |
| cacb33f852ed1a72... | Confirmar cotización.JS | js | 3.7 MB | - | 2026-10-07 | - |
| 8315f56af982fb8f... | Curriculum Vitae.JS | js | 3.1 MB | - | 2026-10-07 | - |
| 36f6f8a754e37a09... | 004911_MT103_001_rejection_000223346.vbs | vbs | 64.5 KB | - | 2026-10-07 | - |
| 4582612d20d85645... | NEW PO M20875.js | js | 691.0 KB | - | 2026-10-07 | - |
| 44c2f46e91c4b65b... | 230294935.exe | exe | 785.0 KB | - | 2026-10-07 | - |
| 1e8a56fd9ff38fdd... | PO_98522891_PN_522517130_.vbs | vbs | 63.0 KB | - | 2026-10-07 | - |
| 14a4b75f7c9504db... | Trial_Order_Requirements_2026_10.vbs | vbs | 62.4 KB | - | 2026-10-07 | - |
| 5209aa6242215875... | SKM_7209435700.js | js | 690.2 KB | - | 2026-10-06 | - |
| fd0d23011657d018... | f45b853c-c9d3-495e-9acb-d41a4a90029f.exe | exe | 240.0 KB | - | 2026-10-06 | - |
| c8398ab9792e1e89... | Purchase_Orders 6000310102700267992_for_Approval Globus Incorporated FZE_pdf.js | js | 648.5 KB | - | 2026-10-06 | - |
| 49565c6e04fbffad... | steinn.ps1 | ps1 | 1.0 MB | - | 2026-10-06 | - |
| 78be24965e3c95bc... | classLincoln.ps1 | ps1 | 1.0 MB | - | 2026-10-06 | - |
| f11e3c6bc6b46f1b... | SOA 7105298330.js | js | 691.4 KB | - | 2026-10-06 | - |
| 0665d268afd27f39... | BIN_ORR_100626wvd2.js | js | 688.0 KB | - | 2026-10-06 | - |
| 9d03c9f9e3fc6b4c... | Factura.js | js | 1.2 MB | - | 2026-10-06 | - |
| 62a5d1c596539f30... | Payment_Advice_pdf.JS | js | 3.2 MB | - | 2026-10-06 | - |
| 51629d8328328333... | PRE-ALERT HCC2025122601.js | js | 689.4 KB | - | 2026-10-06 | - |
| f6dbff36a9064383... | Confirmed_Order_QTY_6413620780.pdf.js | js | 25.1 KB | - | 2026-10-06 | - |
| 1fdc86a58e98b3b3... | Purchase Order.js | js | 20.2 KB | - | 2026-10-06 | - |
| 321df91cd89ca88f... | Formulario_Datos_Bancarios.pdf.js | js | 21.1 KB | - | 2026-10-06 | - |
| 616f88f27ec35f76... | Proforma Invoice.1709-300126270691.JS | js | 3.1 MB | - | 2026-10-06 | - |
| 65789cfdcaf5e8d7... | cotizacion_A7303_THC.js | js | 32.4 KB | - | 2026-10-05 | - |
| d89c479e0ea9bc04... | Request for Outstanding Payment S.O.A 10.01.2026.js | js | 691.9 KB | - | 2026-10-05 | - |
| ca3cf9d7dec92801... | PRE-ALERT NS260234.js | js | 688.4 KB | - | 2026-10-05 | - |
| 1e02e2e7fee40183... | PO06202609160034.js | js | 1.9 MB | - | 2026-10-05 | - |
| 84de969fa7d73412... | stein.ps1 | ps1 | 1.0 MB | - | 2026-10-05 | - |
| 605cbc240f1245ae... | PO # 49388.JS | js | 894.3 KB | - | 2026-10-05 | - |
| 2fa99988277efa08... | Trial_Order_Requirements_2026.vbs | vbs | 109.2 KB | - | 2026-10-05 | - |
| c91fb41b11d29f24... | September_Overpayment_Adjustment_Details.pdf.js | js | 20.2 KB | - | 2026-10-05 | - |
| 98c2feb097ca2d7c... | REQUEST FOR QUOTATION_25117_2026.JS | js | 3.1 MB | - | 2026-10-05 | - |
| 71c9ef680ba54d93... | PRE ALERT No U82420994010052.js | js | 689.2 KB | - | 2026-10-05 | - |
| 9e6709a359282187... | ufgqywxa.JS | js | 3.1 MB | - | 2026-10-05 | - |
| b14e3af3fbdb1508... | 2610051C6FTM.pdf .JS | js | 3.1 MB | - | 2026-10-05 | - |
| a4a239a142be13a6... | New Quotation 10124644.JS | js | 3.1 MB | - | 2026-10-05 | - |
| b40e280b2cae0fbc... | MAN250115028.js | js | 688.0 KB | - | 2026-10-05 | - |
| 000c5eb2d2c402fa... | SOA SEPT 2026.JS | js | 3.1 MB | - | 2026-10-05 | - |
| 26b97bd07b177a13... | Order_Forecast & PO-9458735.js | js | 1.2 MB | - | 2026-10-05 | - |
| fac9bd40b22caf93... | Quotation_MHB-RE-21D-001-26.JS | js | 3.1 MB | - | 2026-10-05 | - |
| 8c800030a784b8ff... | PGD QUOTATION SS27.JS | js | 3.1 MB | - | 2026-10-05 | - |
| f61318a710fa4fbd... | revised Invoice.js | js | 686.0 KB | - | 2026-10-05 | - |
| 46471660502aed37... | Rechnung 103971 GmbH 10-02-2026.rar | rar | 483.5 KB | 23/61 | 2026-10-04 | - |
| 45251b761afc2e6d... | Comprobante de pago.js | js | 30.8 KB | 26/61 | 2026-10-02 | - |
| 11deb13e28a8e3a9... | Rechnung 103971 GmbH 10-02-2026.js | js | 688.2 KB | 25/56 | 2026-10-02 | - |
| a02e305139e8a68b... | Purchase Order 028.rar | rar | 1.3 MB | 28/56 | 2026-10-02 | - |
| a36e737f966731c0... | PO2610-0004 11026.js | js | 1.4 MB | 21/61 | 2026-10-01 | - |
| bedb7fe1edae3544... | PO-002127.js | js | 1.5 MB | 26/61 | 2026-10-01 | - |
| e84ffb9d7b3a622f... | New order.JS | js | 3.2 MB | 6/61 | 2026-10-01 | - |
| 39ef417ff0467a60... | Payment Confirmation_Swift – MT103.JS | js | 3.2 MB | 4/61 | 2026-10-01 | - |
| f9dc18cc11328291... | aongnxsh.JS | js | 3.3 MB | 24/61 | 2026-10-01 | - |
| 1d781609e5e4af51... | PRE ALERT 4106958820.js | js | 688.4 KB | 26/61 | 2026-10-01 | - |
| d4e50ed985bad6e5... | Shipping Documents - PO-2603113056899.JS | js | 3.3 MB | - | 2026-10-01 | - |
| 824c1b3a2cff96ea... | CONFIRMI.JS | js | 1.4 MB | - | 2026-10-01 | - |
| 1d6472657471d066... | Purchase_OrderX#4531101604.xlam | xlsx | 641.2 KB | - | 2026-10-01 | - |
| b15494c671395c45... | Factura pendiente.JS | js | 3.2 MB | - | 2026-10-01 | - |
| e1b30def98704eda... | statement-103217.js | js | 683.2 KB | - | 2026-10-01 | - |
| e76c5c79066d31f5... | Shipment_Invoice_and_Packing_List.com | exe | 766.0 KB | - | 2026-10-01 | - |
| b1ac46bf1cfdbd8a... | RFQ - NHIS 00264859932.js | js | 690.8 KB | - | 2026-09-30 | - |
| 2b010a2351c9e8ee... | P.O 2026-037250.js | js | 672.4 KB | - | 2026-09-30 | - |
| 62165ab180dc2a82... | SHIPMENT DOCUMENTS SCAN_92926tqyp.js | js | 674.4 KB | - | 2026-09-30 | - |
| 7ac3ee7407e452f0... | SHIPMENT.js | js | 684.6 KB | - | 2026-09-30 | - |
| 36cb0eb0fad4a118... | RFQ-9260158400.js | js | 685.6 KB | - | 2026-09-30 | - |
| 63cf3c5fc8658791... | RFQ 5704251439.vbs | vbs | 5.2 MB | - | 2026-09-29 | - |
| c571da34ec2edce2... | MR-2026-135.MSI | msi | 564.0 KB | - | 2026-09-29 | - |
| 052930158bc4e129... | Estado de cuenta (SOA).js | js | 677.3 KB | - | 2026-09-29 | - |
| 64fa2a3b7846e061... | ORDER NOTE.js | js | 664.6 KB | - | 2026-09-29 | - |
| e43f11909ffd6eef... | New Order SPE280903-1.js | js | 691.9 KB | - | 2026-09-29 | - |
| 71343c483f162010... | INVOICE#R09.js | js | 671.8 KB | - | 2026-09-29 | - |
| 52f36733937caeca... | Shipment Documents.JS | js | 3.3 MB | - | 2026-09-28 | - |
| 87ebb8f872170895... | NEW PO 32300337.js | js | 689.5 KB | - | 2026-09-28 | - |
| 8c99f17e2927d4a3... | f45b853c-c9d3-495e-9acb-d41a4a90029f.exe | exe | 239.5 KB | - | 2026-09-28 | - |
| a2f1061b5a9ca952... | MOLD CC 312202.JS | js | 5.3 MB | - | 2026-09-28 | - |