Agent Tesla: New indicators of compromise identified
Twelve new Agent Tesla information stealer samples have been identified, requiring endpoint hash scanning and retrospective threat hunting across Windows environments.
Triage facts
Revision 1- Applicability
- Windows
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 5, 13:34 UTC
- Detection
- 8 IOCs
- Source quality
- A1Likely
Twelve new Agent Tesla information stealer payloads were identified on 2026-11-04. Agent Tesla is a .NET-based malware family known for credential harvesting, keystroke logging, and clipboard exfiltration. These indicators are reported by the ThreatFox community and provide high-confidence artifacts for identifying recent infections.
Impact
Confirmed impact includes the presence of unauthorized information stealer binaries on Windows systems. Possible impact includes credential theft, unauthorized access to sensitive accounts, and exfiltration of system data.
Recommendation
- Implement file integrity monitoring or endpoint protection scans using the provided SHA-256 and MD5 hashes.
- Perform retrospective hunts in endpoint telemetry for the execution of files matching the reported hashes.
- Review network egress logs for connections to unauthorized C2 infrastructure often associated with Agent Tesla patterns.
Immediate actions
Update blocklists with provided file hashes.
Threat Hunt
Retrospective search for known Agent Tesla malicious hashes across endpoint logs.
Data: Endpoint file creation or process execution logs containing hash values.
Indicators of compromise
4
hash_md5
4
hash_sha256
| Type | Value |
|---|---|
| hash_md5 | 9e1eccf2d525a5f1a36eff822229607e |
| hash_sha256 | 5df8d19faea9fab8141875fe86f844291cace363fec5c764e8b5cc11da141b32 |
| hash_md5 | 9ec8a802fe2a11b72b83fa027fb651ed |
| hash_sha256 | ed0f1d1b4673e50dfda972458c7a37b3291086e4f3d72a4464ac92b16b524cf3 |
| hash_md5 | 5c8f88f2c20f31ee0c07917580b694c8 |
| hash_sha256 | adfe94a99972c39c3e53cfaa9b92546b9ff5be4e75b20bc4a0c615a88aac74eb |
| hash_md5 | 57519761cd285b232694e5afc4e3c8bf |
| hash_sha256 | 071e3e45090fd134fad750dff5cfbf2c873ed5c3d1c6826d61bb5ab0bbab1de3 |