{
  "family": "agenttesla",
  "sample_count": 43,
  "category": "infostealer",
  "description": "<h3>Executive Summary</h3>\nAgent Tesla is a highly prevalent, commercially available Information Stealer (InfoStealer) and advanced Keylogger written in .NET. It is sold openly on underground forums under a Malware-as-a-Service (MaaS) model, making it accessible to low-skill threat actors. It is designed to comprehensively harvest sensitive data from infected machines, focusing heavily on corporate email credentials, web browser data, and capturing user keystrokes.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nAgent Tesla is overwhelmingly distributed via targeted phishing and broad malspam campaigns. The emails typically contain malicious ZIP files, ISO images, or weaponized Office documents (using equation editor exploits or macros) that execute the initial dropper.\n\nOnce active, it operates as a stealthy data vacuum:\n<ul>\n<li><strong>Extensive Credential Harvesting:</strong> Agent Tesla targets dozens of specific applications. It decrypts and steals saved passwords from web browsers (Chrome, Edge, Firefox), email clients (Outlook, Thunderbird), FTP clients, and VPN software.</li>\n<li><strong>Surveillance (Keylogging & Screen Capture):</strong> It features a robust keylogger that captures every keystroke. It also routinely takes covert screenshots of the victim's desktop, compiling all this data into hidden, encrypted log files.</li>\n<li><strong>Diverse Exfiltration Methods:</strong> To evade network detection, Agent Tesla supports multiple exfiltration channels. It can send the stolen data back to the attacker via traditional SMTP (email), upload it to a compromised FTP server, or increasingly, abuse the legitimate Telegram API or Discord webhooks to exfiltrate data through trusted encrypted channels.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Agent Tesla infection is a severe data privacy and security breach. The theft of valid corporate email credentials leads directly to catastrophic Business Email Compromise (BEC) fraud, while stolen VPN credentials provide attackers with direct access to the internal network.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Mandatory Credential Reset:</strong> Assume all passwords typed or saved on the infected machine are compromised. Immediately force a password reset for the user's Active Directory account, corporate email, VPN access, and any relevant third-party services.</li>\n<li><strong>MFA Enforcement:</strong> Ensure strict Multi-Factor Authentication (MFA) is enforced across all corporate portals to mitigate the risk of stolen passwords being reused.</li>\n<li><strong>Egress Traffic Analysis:</strong> Because Agent Tesla often uses Telegram or SMTP for exfiltration, review firewall logs for anomalous outbound connections from the endpoint. Block unauthorized use of the Telegram API or non-standard SMTP traffic.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "InfoStealer.AgentTesla",
    "Keylogger.AgentTesla",
    "MSIL/AgentTesla"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Agent Tesla?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A .NET-based spyware trojan, observed since at least 2014, used to steal credentials and log activity on infected machines."
      }
    },
    {
      "@type": "Question",
      "name": "What does Agent Tesla steal?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Saved credentials from browsers and email/FTP clients, keystrokes, clipboard contents, and screenshots."
      }
    },
    {
      "@type": "Question",
      "name": "How is Agent Tesla delivered?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mainly through phishing emails carrying malicious documents or archive attachments."
      }
    },
    {
      "@type": "Question",
      "name": "How does it send stolen data out?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Commonly over email (SMTP), FTP, or messaging services to attacker-controlled accounts."
      }
    },
    {
      "@type": "Question",
      "name": "How can I protect against keyloggers like Agent Tesla?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Use multi-factor authentication so stolen passwords alone are insufficient, be cautious with attachments, and keep endpoint protection updated."
      }
    },
    {
      "@type": "Question",
      "name": "Where is the authoritative reference?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MITRE ATT&CK's Agent Tesla entry (S0331), linked on this page."
      }
    }
  ],
  "faq_count": 6,
  "mitre_attack": [
    "T1056.001",
    "T1555",
    "T1113",
    "T1048"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:47:42Z",
  "overview_short": "AgentTesla is a .NET-based commodity infostealer and keylogger sold as malware-as-a-service. It targets credentials from browsers, email clients, FTP tools, and VPN clients, and exfiltrates over SMTP, FTP, Telegram, or HTTP.",
  "first_seen": "2014",
  "status": "active",
  "iocs": {
    "delivery": [
      "Phishing with ISO/IMG/RAR attachments",
      "Office documents exploiting CVE-2017-11882 (Equation Editor)",
      "Loaders like GuLoader and Snake Keylogger droppers"
    ],
    "network": [
      "SMTP to attacker-controlled mailbox (often a free webmail account)",
      "FTP uploads to compromised legitimate hosts",
      "Telegram Bot API calls to api.telegram.org"
    ],
    "persistence": [
      "Copy to %APPDATA% with randomized filename",
      "Run key under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
      "Scheduled task with hidden window"
    ]
  },
  "detection": [
    "YARA rule AgentTesla_Stealer from public repos",
    "Network rule for SMTP authentication from non-mail-server hosts",
    "EDR rule for RegAsm.exe or AppLaunch.exe with no parent IDE process"
  ],
  "containment_steps": [
    "Isolate host and capture memory if possible",
    "Rotate all credentials stored in browsers, FTP clients, email clients on the host",
    "Revoke and reissue VPN certificates used on the host",
    "Block known SMTP/FTP exfil endpoints and Telegram if not business-essential"
  ],
  "what_to_avoid": [
    "Do not just delete the binary — credentials are likely already exfiltrated",
    "Do not assume free webmail SMTP destinations are benign",
    "Do not skip user notification — phishing targeting their contacts often follows"
  ],
  "references": [
    {
      "title": "CISA: Top Malware Strains of 2021 (Agent Tesla)",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-216a"
    },
    {
      "title": "Fortinet FortiGuard: AgentTesla Analysis",
      "url": "https://www.fortinet.com/blog/threat-research/new-variant-of-agent-tesla-spreads-by-phishing"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Spearphishing Attachment"
    },
    {
      "id": "T1056.001",
      "name": "Keylogging"
    },
    {
      "id": "T1555.003",
      "name": "Credentials from Web Browsers"
    },
    {
      "id": "T1048.003",
      "name": "Exfiltration Over Unencrypted Non-C2 Protocol"
    }
  ],
  "sources": [
    {
      "name": "MITRE ATT&CK: Agent Tesla (S0331)",
      "url": "https://attack.mitre.org/software/S0331"
    }
  ],
  "mitre_url": "https://attack.mitre.org/software/S0331",
  "type": "InfoStealer / Keylogger",
  "target_industries": [
    "Financial Services",
    "Retail",
    "Consumers"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}