Agenttesla

Overview

Executive Summary

Infection Vector and Technical Capabilities

• Extensive Credential Harvesting: Agent Tesla targets dozens of specific applications. It decrypts and steals saved passwords from web browsers (Chrome, Edge, Firefox), email clients (Outlook, Thunderbird), FTP clients, and VPN software.
• Surveillance (Keylogging & Screen Capture): It features a robust keylogger that captures every keystroke. It also routinely takes covert screenshots of the victim's desktop, compiling all this data into hidden, encrypted log files.
• Diverse Exfiltration Methods: To evade network detection, Agent Tesla supports multiple exfiltration channels. It can send the stolen data back to the attacker via traditional SMTP (email), upload it to a compromised FTP server, or increasingly, abuse the legitimate Telegram API or Discord webhooks to exfiltrate data through trusted encrypted channels.

Threat Assessment

Incident Response and Remediation

• Mandatory Credential Reset: Assume all passwords typed or saved on the infected machine are compromised. Immediately force a password reset for the user's Active Directory account, corporate email, VPN access, and any relevant third-party services.
• MFA Enforcement: Ensure strict Multi-Factor Authentication (MFA) is enforced across all corporate portals to mitigate the risk of stolen passwords being reused.
• Egress Traffic Analysis: Because Agent Tesla often uses Telegram or SMTP for exfiltration, review firewall logs for anomalous outbound connections from the endpoint. Block unauthorized use of the Telegram API or non-standard SMTP traffic.

Known aliases

Threat reports may refer to this family under multiple names:

• InfoStealer.AgentTesla
• Keylogger.AgentTesla
• MSIL/AgentTesla

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure.

Delivery vectors

• Phishing with ISO/IMG/RAR attachments
• Office documents exploiting CVE-2017-11882 (Equation Editor)
• Loaders like GuLoader and Snake Keylogger droppers

Network indicators

• SMTP to attacker-controlled mailbox (often a free webmail account)
• FTP uploads to compromised legitimate hosts
• Telegram Bot API calls to api.telegram.org

Persistence mechanisms

• Copy to %APPDATA% with randomized filename
• Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run
• Scheduled task with hidden window

Detection Guidance

Detection ideas drawn from public reporting. Tune to your environment before deploying.

• YARA rule AgentTesla_Stealer from public repos
• Network rule for SMTP authentication from non-mail-server hosts
• EDR rule for RegAsm.exe or AppLaunch.exe with no parent IDE process

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_AGENTTESLA {
    meta:
        description = "Detects Agenttesla (infostealer)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "agenttesla" ascii wide nocase
        $s2 = "infostealer.agenttesla" ascii wide nocase
        $s3 = "keylogger.agenttesla" ascii wide nocase
        $s4 = "msil/agenttesla" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Agenttesla Activity
id: 6aafae42beb96c4465d1982306e7285b
status: experimental
description: Detects generic indicators of the agenttesla malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*agenttesla*"
            - "*infostealer.agenttesla*"
            - "*keylogger.agenttesla*"
            - "*msil/agenttesla*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate host and capture memory if possible
2. Rotate all credentials stored in browsers, FTP clients, email clients on the host
3. Revoke and reissue VPN certificates used on the host
4. Block known SMTP/FTP exfil endpoints and Telegram if not business-essential

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not just delete the binary — credentials are likely already exfiltrated
2. Do not assume free webmail SMTP destinations are benign
3. Do not skip user notification — phishing targeting their contacts often follows

References & External Analysis

• MITRE ATT&CK: Agent Tesla (S0331)
• Search "agenttesla" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: infostealer)

Explore other malware families in the same category:

• Olgames
• Socelars
• Ponystealer
• Fareit
• Berbew

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/agenttesla.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.