Agenttesla

Overview

Agent Tesla is an accessible, highly ubiquitous commercial info-stealer and keylogger built on the Microsoft .NET framework. First surfacing in late 2014, the tool was initially marketed openly as a legitimate remote management and parental surveillance tool on clearnet websites before transitioning into an underground Malware-as-a-Service (MaaS) staple. Agent Tesla specializes in harvesting stored authentication credentials from dozens of desktop applications, including web browsers (Google Chrome, Mozilla Firefox, Microsoft Edge), email clients (Outlook, Thunderbird), FTP utilities (FileZilla, WinSCP), and VPN software. Additionally, it records keystrokes, captures clipboard contents, and periodically takes desktop screenshots. The malware is notable for its versatile and redundant exfiltration methods: operators can configure the binary to dispatch captured telemetry back to them over outbound SMTP email, FTP uploads, direct HTTP POSTs to custom web panels, or via the Telegram Bot API and Discord webhooks. Agent Tesla is predominantly distributed as malicious attachments in spear-phishing campaigns targeting supply chain, shipping, logistics, and energy organizations.

Known aliases

Threat reports may refer to this family under multiple names:

• Agent Tesla
• AgentTesla
• InfoStealer.AgentTesla
• Keylogger.AgentTesla
• MSIL/AgentTesla

Threat Actor Attribution

Attribution is probabilistic, not a science. Each link below states its confidence level and the evidence behind it.

• Commercial Malware-as-a-Service (MaaS) Syndicate High confidence
  Basis: Originally marketed openly on underground forums and dedicated clearnet storefronts starting in 2014 under the guise of an 'employee and child monitoring solution'. It is leased on cybercrime forums to hundreds of independent threat actors and Business Email Compromise (BEC) operators worldwide. [source]

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Known Derivatives & Downstream Variants: Origin Logger

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

• CVE-2017-11882 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2018-0802 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2017-8570 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).

Command & Control (C2) and Network Profile

How this family talks to its operators. C2 traffic can often identify a family even when its code and configuration are hard to analyse. Ports and patterns are historical and change between campaigns, so use them as hunting leads rather than block-only rules.

Network detection ideas

• Block outbound SMTP (ports 25, 587, 465) directly from non-mail server endpoints
• Inspect and flag non-browser processes initiating connections to api.telegram.org and discordapp.com/api/webhooks
• Detect and alert on Equation Editor processes (eqnedt32.exe) spawning PowerShell, RegAsm, or child binary loaders

Sources: CISA Advisory AA20-302A, MITRE ATT&CK S0331

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• 787c88019a3b2b8004128f73aa128362ea7ae510eb33ee3518c8e19e58e3bb34
• bb855581b89cb9be5c48b26a6dbdeff54bdf164177d6ee2bf2a488e07ddae80a
• 11d1cf9c9535eb0429f6d4d1aa471d8be8d52317926e84d436ef8f7586faae95

Delivery vectors

• Phishing emails with attached ISO, RAR, or ZIP archives
• Weaponized Office documents exploiting CVE-2017-11882

Persistence mechanisms

• Startup folder shortcuts or Run registry entries pointing to obfuscated .NET loaders
• Process hollowing into RegAsm.exe, MSBuild.exe, or svchost.exe

Detection Guidance

Detection ideas drawn from public reporting. Tune to your environment before deploying.

• YARA rule AgentTesla_Stealer from public repos
• Network rule for SMTP authentication from non-mail-server hosts
• EDR rule for RegAsm.exe or AppLaunch.exe with no parent IDE process

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_AGENTTESLA_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Agenttesla"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "agenttesla" ascii wide nocase
        $s2 = "agent tesla" ascii wide nocase
        $s3 = "agenttesla" ascii wide nocase
        $s4 = "infostealer.agenttesla" ascii wide nocase
        $s5 = "keylogger.agenttesla" ascii wide nocase
        $s6 = "msil/agenttesla" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Agenttesla (Infostealer) Execution & Triage
id: 54198b01-7d97-5e29-bac0-aa69ba135f2b
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Agenttesla malware family. Detects browser credential database harvesting,
  master key queries, and DPAPI extraction routines typical of modern infostealers.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/agenttesla
- https://malware-families-catalog.systemhelpdesk.com/defensive/infostealer-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.infostealer
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1056_001
- attack.t1555
- attack.t1113
- attack.t1048
- attack.t1055_012
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \rundll32.exe
    CommandLine|contains:
    - \Google\Chrome\User Data\Default\Login Data
    - \AppData\Roaming\Mozilla\Firefox\Profiles
    - \AppData\Local\Microsoft\Edge\User Data
    - vaultcmd.exe /list
    - dpapi
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: high

rule MALWARE_WIN_AGENTTESLA_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Agenttesla tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "agenttesla" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate host and capture memory if possible
2. Rotate all credentials stored in browsers, FTP clients, email clients on the host
3. Revoke and reissue VPN certificates used on the host
4. Block known SMTP/FTP exfil endpoints and Telegram if not business-essential

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not just delete the binary — credentials are likely already exfiltrated
2. Do not assume free webmail SMTP destinations are benign
3. Do not skip user notification — phishing targeting their contacts often follows

References & External Analysis

• MITRE ATT&CK: Agent Tesla (S0331)
• CISA Advisory: CISA Alert AA20-302A (Top Routinely Exploited Vulnerabilities)
• Search "agenttesla" on VirusTotal (External Analysis)
• Search "agenttesla" on Any.Run (Sandbox Sandbox)
• Search "agenttesla" on MalwareBazaar (Malware Samples)

North American Authority Advisory (CISA / NIST)

The Cybersecurity and Infrastructure Security Agency (CISA) has published an official US federal advisory on this family, which can be mapped to NIST Cybersecurity Framework (CSF) incident response controls: CISA Alert AA20-302A (Top Routinely Exploited Vulnerabilities) ↗

Frequently Asked Questions

Related Threats (Category: Infostealer)

Explore other documented threats in the same operational category:

• Pony
• Olgames
• Yunsip
• Lumma
• Vidar
• Papras
• Lynx
• Banspy

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/agenttesla.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.