Agent Tesla
Executive Summary
Agent Tesla is a remote access trojan (RAT) written in .NET that has been actively targeting users with Microsoft Windows OS-based systems since 2014. It is a versatile malware with a wide range of capabilities, including sensitive information stealing, keylogging, and screenshot capture. Since its release, this malicious software has received regular updates. It is sold as malware-as-a-service, with several subscription options available for purchase. Campaigns involving Agent Tesla often start with phishing emails, masquerading as legitimate messages from trusted sources.
Overview
Description
Type: Information-stealing Remote Access Trojan (RAT) sold as Malware-as-a-Service (MaaS)
Delivery:
Primarily distributed through phishing campaigns using malicious attachments such as .zip / .rar archives, malicious Office documents with macros, .img / .iso disk images, and .exe, .js, .vbs, or .lnk droppers. The payload is often delivered through multi-stage loaders such as GuLoader, Snake Keylogger loaders, .NET downloaders, and PowerShell download chains. Attachments frequently impersonate invoices, purchase orders, shipping notices, or financial documents.
Capabilities:
Credential harvesting from web browsers (Chrome, Firefox, Edge, Opera), email credential theft from clients such as Outlook and Thunderbird, FTP credential extraction, keylogging of user keystrokes, clipboard monitoring, screenshot capture, system reconnaissance (hostname, IP, OS version), data exfiltration via SMTP, FTP, HTTP, or Telegram APIs, and persistence via registry Run keys or startup folders. Stolen data is periodically transmitted to attacker-controlled infrastructure.
Notable Characteristics:
Written in .NET, making it easy to modify and recompile. Widely sold on underground forums as a subscription-based MaaS tool. Often delivered through commodity malware loaders. Heavy use of string obfuscation, Base64 encoding, and packing. Frequent variant churn due to builder kits used by different operators. Exfiltration frequently uses SMTP or Telegram bots, which helps evade traditional C2 detection.
Attack Flow
Flow
Phishing Email → Word Attachment → Embedded RTF / Excel Object → Macro Execution → PowerShell Download → .NET Loader → Process Injection (RegSvcs.exe / RegAsm.exe) → Agent Tesla Execution → Credential Harvesting → SMTP / HTTP Exfiltration
- Victim receives an email impersonating invoices, shipping notices, or purchase orders
- Email contains a Word document or archive containing the malicious file
- Document loads an embedded RTF or Excel object that triggers macro execution
- Macro launches PowerShell to retrieve a remote payload
- A .NET loader, often GuLoader or similar, downloads and decrypts the Agent Tesla payload
- The loader injects the payload into legitimate Windows processes such as RegSvcs.exe or RegAsm.exe
- Malware begins credential harvesting and system reconnaissance
- Stolen credentials and system data are transmitted to attacker infrastructure via SMTP, FTP, HTTP, or Telegram APIs
MITRE ATT&CK Techniques
MITRE ATT&CK
- T1087.001 – Account Discovery - Local Account
- T1071.001 – Application Layer Protocol - Web Protocols
- T1071.003 – Application Layer Protocol - Mail Protocols
- T1560 – Archive Collected Data
- T1547.001 – Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
- T1185 – Browser Session Hijacking
- T1115 – Clipboard Data
- T1555 – Credentials from Password Stores
- T1555.003 – Credentials from Password Stores - Credentials from Web Browsers
- T1140 – Deobfuscate/Decode Files or Information
- T1048.003 – Exfiltration Over Unencrypted Non-C2 Protocol
- T1203 – Exploitation for Client Execution
- T1564.001 – Hide Artifacts - Hidden Files and Directories
- T1564.003 – Hide Artifacts - Hidden Window
- T1562.001 – Impair Defenses - Disable or Modify Tools
- T1105 – Ingress Tool Transfer
- T1056.001 – Input Capture - Keylogging
- T1112 – Modify Registry
- T1027 – Obfuscated Files or Information
Detections
Detection Rules
| Rule | View | Download |
|---|---|---|
| YARA | View | Download |
| Suricata | View | Download |
| SPL | View | Download |