# Agent Tesla

Spyware / RAT (MaaS) · First seen 2014

## Overview

Agent Tesla is a .NET-based spyware Trojan and remote access tool that has been sold as malware-as-a-service since at least 2014. [MITRE ATT&CK tracks it as software S0331](https://attack.mitre.org/software/S0331/) and links its use to the SilverTerrier Nigerian business-email-compromise cluster and the phishing group TA2541. It is one of the longest-running commodity keyloggers still in active distribution, and its leaked builder has spawned a direct successor, [OriginLogger](https://malpedia.caad.fkie.fraunhofer.de/details/win.originlogger), which reuses Agent Tesla's code and configuration handling so closely that many Agent Tesla detection rules still catch it.

Agent Tesla is not a ransomware precursor loader in the way some infostealers are. It is a self-contained keylogger and credential harvester built around a single subscription-based builder. Affiliates configure their own phishing lure, C2 channel, and exfiltration protocol, then distribute the resulting binary independently. This makes every Agent Tesla sample slightly different at the byte level while the underlying behavior, credential harvesting, keystroke logging, screenshot capture, and mail/HTTP/FTP/Telegram exfiltration, stays consistent across builds.

The malware's staying power comes from low barrier to entry rather than technical novelty. [HHS's Health Sector Cybersecurity Coordination Center documented Agent Tesla campaigns exploiting Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2017-8570](https://www.hhs.gov/sites/default/files/remote-access-trojan-agent-tesla-targets-organizations-covid-themed-phishing-attacks.pdf) during a 2020 wave of COVID and PPE-themed phishing; the underlying exploitation and phishing patterns are still in use, with only the thematic wrapper changing. Recent campaign reporting from sandbox analysis describes business-document lures, purchase orders, invoices, payroll files, and procurement requests, replacing the pandemic-era themes.

Agent Tesla is not used for lateral movement or ransomware deployment. It is a single-host credential and surveillance tool. Its downstream risk comes from what happens to the harvested data: stolen mailbox and VPN credentials feed business email compromise, and law enforcement action, including [Interpol arrests tied to Agent Tesla-assisted financial crime](https://www.bleepingcomputer.com/news/security/three-nigerians-arrested-for-malware-assisted-financial-crimes/), has repeatedly connected the malware to BEC fraud rings operating out of West Africa.

### Threat profile

Updated August 18, 2026

| Type | First seen | MITRE | Downstream |
|---|---|---|---|
| Spyware / RAT (MaaS) | 2014 | S0331 | BEC fraud |

| Details | Value |
|---|---|
| Aliases | AgentTesla, Negasteal |
| Attributed groups | SilverTerrier · TA2541 |
| Delivery vectors | Spearphishing attachment · Office exploits · macros · archives |
| Primary targets | Windows endpoints, business users |
| Exfil channels | SMTP · HTTP · FTP · Telegram |
| Related malware | OriginLogger |

## Operational attack chain: Phishing-to-Agent Tesla

1. **Phishing email**
   - Invoice, purchase order, or payroll lure.
2. **Attachment opened**
   - RAR, ISO, macro doc, or RTF exploit.
3. **JScript / VBS loader**
   - `wscript` / `mshta` hands off to PowerShell.
4. **In-memory .NET loader**
   - Reflective load. No disk write of the payload.
5. **Process hollowing**
   - `RegAsm.exe` / `MSBuild.exe` launched suspended, then hollowed.
6. **Credentials harvested**
   - Browser, mail, FTP, Wi-Fi, keystrokes, screenshots, clipboard.
7. **Exfil to attacker**
   - SMTP / HTTP / FTP / Telegram. Feeds mailbox takeover and BEC fraud.
   - BEC
   - SilverTerrier

Agent Tesla does not require an exploit to execute. Where CVE-2017-11882/CVE-2017-8570 exploitation is absent, affiliates substitute macro-enabled documents or script loaders that rely entirely on user execution, so the same kill chain plays out with or without a vulnerable Office build.

Source: MITRE ATT&CK (S0331), HHS HC3, sandbox campaign analysis, 2020—2026

## Tactics, techniques, and procedures

Agent Tesla maps to MITRE ATT&CK Enterprise techniques spanning initial access through exfiltration, with the highest density in Discovery, Credential Access, and Collection.

### MITRE ATT&CK coverage

| Tactic | Coverage |
|---|---|
| Recon | Not observed (0) |
| Resource Dev | Not observed (0) |
| Initial Access | Active (1) |
| Execution | Active (2) |
| Persistence | Active (2) |
| Priv. Esc | Not observed (0) |
| Defense Evasion | Heavy (8) |
| Credential Access | Heavy (5) |
| Discovery | Heavy (3) |
| Lateral | Not observed (0) |
| Collection | Heavy (3) |
| C2 | Active (2) |
| Exfiltration | Active (1) |
| Impact | Not observed (0) |

### Technique detail

| Tactic | Techniques | What Agent Tesla does |
|---|---|---|
| Initial Access | [Spearphishing Attachment T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Business-themed emails carrying invoice, purchase-order, payroll, or procurement lures. Opening the attachment is the execution mechanism. |
| Execution | [Exploitation for Client Execution T1203](https://attack.mitre.org/techniques/T1203/); [Malicious File T1204.002](https://attack.mitre.org/techniques/T1204/002/) | CVE-2017-11882 / CVE-2017-8570 when Office is unpatched; otherwise a macro-enabled document, RTF, or script loader inside a RAR, ZIP, or ISO. No exploit is required. |
| Persistence | [Registry Run Keys T1547.001](https://attack.mitre.org/techniques/T1547/001/); [Scheduled Task T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Registry Run keys or scheduled tasks, affiliate-configured. Many campaigns skip persistence — a keylogger only needs one login session. |
| Defense Evasion | [Obfuscated Files T1027](https://attack.mitre.org/techniques/T1027/); [Deobfuscate / Decode T1140](https://attack.mitre.org/techniques/T1140/); [Sandbox Evasion T1497](https://attack.mitre.org/techniques/T1497/); [Process Hollowing T1055.012](https://attack.mitre.org/techniques/T1055/012/); [Regsvcs / Regasm T1218.009](https://attack.mitre.org/techniques/T1218/009/); [Hidden Files T1564.001](https://attack.mitre.org/techniques/T1564/001/); [Hidden Window T1564.003](https://attack.mitre.org/techniques/T1564/003/); [Disable or Modify Tools T1685](https://attack.mitre.org/techniques/T1685/) | Rijndael-encrypted strings decoded only at runtime. Payload hollows `RegAsm.exe` or `MSBuild.exe`, hides windows, and can terminate analysis or security processes it finds running. |
| Credential Access | [Credentials from Browsers T1555.003](https://attack.mitre.org/techniques/T1555/003/); [Password Stores T1555](https://attack.mitre.org/techniques/T1555/); [Credentials in Files T1552.001](https://attack.mitre.org/techniques/T1552/001/); [Credentials in Registry T1552.002](https://attack.mitre.org/techniques/T1552/002/); [Keylogging T1056.001](https://attack.mitre.org/techniques/T1056/001/) | Harvests browser, mail, and FTP credentials, plus Wi-Fi passwords via `netsh wlan show profile … key=clear`. Keylogs in real time and form-grabs data before TLS protects it. |
| Discovery | [Wi-Fi Discovery T1016.002](https://attack.mitre.org/techniques/T1016/002/); [Process Discovery T1057](https://attack.mitre.org/techniques/T1057/); [System Information T1082](https://attack.mitre.org/techniques/T1082/) | Enumerates saved wireless profiles, running processes, and WMI virtualization identifiers (VMware, VirtualBox, Hyper-V) before collecting anything. |
| Collection | [Screen Capture T1113](https://attack.mitre.org/techniques/T1113/); [Clipboard Data T1115](https://attack.mitre.org/techniques/T1115/); [Archive Collected Data T1560](https://attack.mitre.org/techniques/T1560/) | Periodic desktop screenshots, clipboard monitoring, and in some builds webcam video. Collected material is archived and encrypted with 3DES before transmission. |
| Command and Control | [Web Protocols T1071.001](https://attack.mitre.org/techniques/T1071/001/); [Mail Protocols T1071.003](https://attack.mitre.org/techniques/T1071/003/) | Builder-configurable SMTP, HTTP, FTP, or Telegram Bot API. SMTP to an external mail relay has historically been the most common channel. |
| Exfiltration | [Exfil Over Unencrypted Non-C2 T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Stolen data leaves over the configured channel — SMTP, HTTP POST, FTP upload, or Telegram `sendDocument` / `sendMessage` — straight to the attacker. |
| Recon / Resource Dev / Priv Esc / Lateral / Impact | — | Not observed. Agent Tesla is a single-host credential and surveillance tool; it is not used for lateral movement or ransomware deployment. |

### Stage 1: How the attack starts

T1566.001 · T1203 · T1204.002

Agent Tesla's entry point has stayed the same since 2014: an email that looks like ordinary business correspondence. [HHS HC3 documented a PPE-themed wave in 2020](https://www.hhs.gov/sites/default/files/agent-tesla-phishing.pdf) that rotated IP addresses and sample hashes on a 10-day cycle while keeping the email body text nearly identical, an operational pattern of thematic disposability that persists today. Current campaigns replace pandemic themes with invoices, purchase orders, payroll notices, and procurement requests aimed at employees who routinely handle external files and supplier communication.

The attachment vector varies by build. MITRE documents exploitation of the Office Equation Editor vulnerabilities CVE-2017-11882 and CVE-2017-8570 for silent execution when the target has an unpatched Office install. Where the target is patched, affiliates fall back to macro-enabled Word or PowerPoint documents, RTF files, or password-protected archives (RAR, ZIP, ISO) containing a script loader. Both paths converge on the same downstream chain once the initial file executes.

No exploit is strictly required. A macro-enabled document or a script loader inside an archive achieves the same outcome as an unpatched Office exploit: it converts the recipient into the execution mechanism. This is why attachment-opening behavior and script-interpreter telemetry matter as much as patch status when scoping detection coverage.

### Stage 2: What runs on the endpoint

T1204.002 · T1547.001 · T1053.005 · T1218.009

A representative execution chain observed across multiple Agent Tesla campaigns runs: RAR or ISO attachment, a JScript or VBScript loader (`.jse`/`.vbs`), a first PowerShell stage that downloads a second obfuscated PowerShell stage, which reflectively loads a .NET loader assembly entirely in memory, which in turn decrypts and loads the final Agent Tesla payload. No stage after the initial script needs to touch disk as an unpacked executable.

The final payload does not run as its own visible process. MITRE documents Agent Tesla dropping `RegAsm.exe` onto systems and using process hollowing to execute inside it: a legitimate .NET utility is launched in a suspended state, its memory is cleared, and the Agent Tesla payload is written into the hollowed space before the thread resumes. `MSBuild.exe` is used the same way in other builds. Because the process name on screen is a signed Microsoft utility, static allow-listing and signature checks alone will not flag it.

Persistence is affiliate-configured rather than universal. Agent Tesla can add itself to Registry Run keys to survive reboot, or establish a scheduled task. A meaningful share of campaigns skip persistence altogether: a keylogger only needs to survive long enough to capture one login session, so some affiliates prioritize stealth over durability.

### Stage 3: How the malware evades detection

T1027 · T1140 · T1497 · T1055.012 · T1564.001 · T1564.003 · T1685

Every stage of the loader chain is obfuscated. Agent Tesla encrypts strings with the Rijndael symmetric algorithm and decrypts them only at runtime, so static string scanning of the on-disk artifact reveals little. Layered packing means the true .NET payload is only exposed after several stages of in-memory decoding.

Before collecting anything, the payload checks whether it is being watched. Agent Tesla performs anti-sandbox and anti-virtualization checks, commonly by querying WMI for indicators of VMware, VirtualBox, or Hyper-V, and by looking for DLLs associated with analysis tooling and lightweight sandboxes loaded into its own process. If it finds them, some builds terminate immediately rather than reveal behavior to an analyst.

Process hollowing (T1055.012) is the core evasion mechanic once the payload is ready to run persistently: launching a trusted .NET binary suspended, replacing its memory, and resuming it means the visible process name, signature, and parent lineage all look legitimate. Agent Tesla also creates hidden folders and runs child processes with `ProcessWindowStyle.Hidden` so no window ever appears to the user, and it can enumerate and terminate analysis or security processes it detects running (T1685).

### Stage 4: What it tries to access or modify

T1555.003 · T1555 · T1552.001 · T1552.002 · T1056.001 · T1113 · T1115 · T1560

Agent Tesla's core objective is credential and surveillance data, not encryption or destruction. It gathers credentials from a broad set of browsers, and separately extracts credentials stored by FTP clients and saved wireless network profiles. Wi-Fi credentials are pulled by spawning `netsh.exe` with a `show profile … key=clear` argument, which forces Windows to display the stored password in plaintext for each saved SSID. Credentials left behind in configuration files or written into the Registry by other applications are extracted directly (T1552.001, T1552.002).

Beyond stored secrets, the malware actively monitors the user in real time. It logs every keystroke, captures periodic screenshots of the desktop, and in some builds records webcam video. It also monitors the clipboard and uses form-grabbing to intercept data as it is typed into web forms, before browser-native encryption or TLS ever protects it. Collected material is archived and encrypted with 3DES prior to transmission, which is a confidentiality measure for the attacker, not an evasion technique against the endpoint.

What makes this collection dangerous for defenders is not any single API call. It is a process with no legitimate reason to touch `Login Data`, `logins.json`, an FTP client's saved-site file, and the keyboard input stream all within the same session, shortly after a script-driven execution chain. Each access is individually plausible; the combination is not.

### Process tree

#### What the kill chain looks like in EDR telemetry

```text
outlook.exe [PID 2988]                                        // attachment opened by user
└─ winrar.exe / wscript.exe [PID 4416]                        extract + run .jse
   └─ powershell.exe [PID 6120]                               -enc [base64]
      └─ powershell.exe [PID 6284]                            reflective load .NET loader assembly, in-memory
         └─ RegAsm.exe [PID 6402]                             launched suspended → hollowed
            └─ [Agent Tesla payload, memory only]             running as RegAsm.exe

RegAsm.exe (hollowed)                                         reads browser Login Data, logins.json, FTP site config
└─ netsh.exe [PID 6588]                                       wlan show profile [SSID] key=clear
└─ RegAsm.exe → SMTP / HTTPS POST / FTP / Telegram Bot API
```

- Suspicious: Script loader; `netsh.exe` Wi-Fi credential discovery.
- Malicious: Encoded PowerShell and in-memory loading.
- Critical: Process hollowing, credential-store access, and data exfiltration.

## Where Malware Protection Plus fits

A walkthrough showing detection of the script-to-hollowed-process execution chain, automated containment of the affected endpoint, and forensic capture of exfiltration artifacts.

Agent Tesla's evasion depends on looking like a trusted process. Endpoint security teams should monitor for the sequence rather than any single artifact: a script interpreter spawning PowerShell, PowerShell reflectively loading a .NET assembly, and a normally quiet utility like `RegAsm.exe` or `MSBuild.exe` suddenly reading browser credential stores and opening outbound SMTP or HTTP connections it has no legitimate reason to make.

Malware Protection Plus helps security teams detect this kind of suspicious endpoint behavior, isolate the affected system before harvested credentials leave the network, investigate the root cause across the phishing-to-hollowed-process chain, and support faster remediation and restoration of the endpoint.

## Indicators of compromise

Agent Tesla is built per affiliate from a shared builder, so hashes, C2 domains, and lure filenames rotate constantly. Indicators below are separated into durable behavioral patterns that survive variant rotation, and volatile indicators that expire quickly and should be treated as short-lived hunting leads.

### File and process artifacts

**Durable**

Behavioral artifacts that survive variant rotation. Hashes and lure names do not.

- `RegAsm.exe / MSBuild.exe with network sockets`
  - Neither utility legitimately opens outbound connections.
- `HKCU\...\CurrentVersion\Run [random name]`
  - Persistence, when affiliate-configured.
- `HKLM\...\TaskCache\Tasks [new task]`
  - Scheduled task persistence variant.
- `netsh.exe wlan show profile [SSID] key=clear`
  - Plaintext Wi-Fi credential extraction.

### Process tree patterns

**Durable**

Parent-child execution chains that signal a phishing-to-Agent Tesla kill chain in progress.

- `outlook.exe / winword.exe → wscript.exe / mshta.exe`
  - Office/mail client spawning script interpreters.
- `wscript.exe → powershell.exe -enc [base64]`
  - Script loader to encoded PowerShell stage.
- `powershell.exe → RegAsm.exe (suspended, then hollowed)`
  - Process hollowing into a signed .NET utility.
- `[hollowed utility] → Login Data / logins.json / FTP config`
  - Credential store read from a non-browser, non-client process.

### Infrastructure

**Volatile**

Expires quickly. Treat as short-lived hunting leads, not durable detections.

- `File hashes (unique per builder output)`
  - Every affiliate build produces distinct hashes.
- `C2 mail relay / HTTP panel domain or IP`
  - Rotates per campaign and per affiliate.
- `Phishing sender address / subject line`
  - Historically rotated on roughly a 10-day cycle.
- `Attachment filename (invoice / PO / payroll)`
  - Theme rotates with current events and industry.

### Network behavior

**Volatile**

Outbound traffic patterns that rotate with each affiliate's C2 configuration.

- `api.telegram.org sendDocument / sendMessage`
  - Telegram Bot API from a non-Telegram process.
- `Outbound SMTP from a non-mail-client process`
  - Historically the most common exfil channel for this family.
- `FTP upload to an unfamiliar external host`
  - Legacy exfil channel, still configurable.

## Detection guidance

Static, hash-based scanning is a poor fit for Agent Tesla because the builder produces a unique binary per affiliate. What defenders can detect reliably is the sequence: a script interpreter spawned from an email client, followed by encoded PowerShell, followed by a hollowed system utility that suddenly touches credential stores and opens outbound connections it has no reason to make.

### 1. Office/mail client spawning script interpreters

**Endpoint telemetry**

**What to monitor:** `outlook.exe`, `winword.exe`, or `powerpnt.exe` spawning `wscript.exe`, `cscript.exe`, or `mshta.exe`, especially where the script file originated from a recently opened email attachment or extracted archive.

**Why it works:** legitimate business documents do not spawn script interpreters. This parent-child relationship is the earliest reliable signal in the chain.

### 2. Encoded or downloaded PowerShell stages

**Script block logging**

**What to monitor:** PowerShell invoked with `-enc`/`-EncodedCommand`, or making an outbound web request to fetch a second-stage script, followed by reflective assembly loading (`Assembly.Load` patterns in script block logs).

**Why it works:** reflective in-memory loading is the mechanism that keeps the final .NET payload off disk. Script block logging captures the command before it self-obfuscates further.

### 3. Process hollowing into RegAsm.exe or MSBuild.exe

**EDR / memory telemetry**

**What to monitor:** a .NET utility launched in a suspended state, followed by memory writes into that process from a different parent, followed by resumption. Also flag either binary if it later opens network sockets or file handles to browser profile directories.

**Why it works:** `RegAsm.exe` and `MSBuild.exe` have no legitimate reason to make outbound network connections or read browser credential stores. Any instance doing so should be treated as compromised.

### 4. Sandbox and VM fingerprinting queries

**WMI / API telemetry**

**What to monitor:** WMI queries for virtualization indicators (VMware, VirtualBox, Hyper-V identifiers) or process/module enumeration checking for known analysis-tool DLLs, issued by a freshly spawned, unsigned or hollowed process.

**Why it works:** this behavior has no purpose for a legitimate application. Its presence right after a script-execution chain is a strong evasion-stage signal, though it also appears in benign inventory and licensing tools, so correlate rather than alert in isolation.

### 5. Credential store access from a non-owning process

**File access telemetry**

**What to monitor:** reads of browser `Login Data`, Firefox `logins.json`/`key4.db`, FTP client site configuration files, or saved mail client credentials by any process other than the application that owns them.

**Why it works:** browsers, FTP clients, and mail clients read their own credential stores; nothing else should. A hollowed system utility reading these files is unambiguous.

### 6. Anomalous outbound SMTP, FTP, or Telegram Bot API traffic

**Firewall / DLP / proxy logs**

**What to monitor:** outbound SMTP connections to unfamiliar external relays from a non-mail-client process, FTP uploads to unfamiliar hosts, or HTTPS requests to `api.telegram.org` endpoints (`sendDocument`, `sendMessage`) originating from a process other than the Telegram desktop or web client.

**Why it works:** each channel is a single-purpose tell. Telegram Bot API traffic in particular has a narrow, well-defined legitimate use case, making unexpected callers easy to isolate once a baseline exists.

## Hardening recommendations

The controls below reduce the attack surface Agent Tesla depends on: macro execution, unpatched Office builds, and unrestricted script interpreters. **Quick win** = single GPO or rule, deployable in days. **Standard** = needs audit-mode rollout, deployable in weeks.

### 1. Block macros in documents from the internet

**Quick win**

Configure Office to block macros in files carrying the Mark of the Web by default, removing the most common non-exploit execution path for this family.

**Path:** User Configuration → Administrative Templates → Microsoft Office → Security Settings → Block macros from running in Office files from the internet.

### 2. Patch Office against CVE-2017-11882 and CVE-2017-8570

**Quick win**

These Equation Editor vulnerabilities remain in active use by Agent Tesla campaigns years after patches were released. Confirm all Office installs, including legacy or unmanaged endpoints, are current.

**Verify:** Confirm Office update channel status and Equation Editor (`EQNEDT32.EXE`) patch level across managed endpoints.

### 3. Enable PowerShell script-block logging

**Quick win**

Script-block logging captures the encoded and downloaded PowerShell stages before they decode and reflectively load the .NET payload, closing the visibility gap that pure process-name monitoring misses.

**Path:** Computer Configuration → Administrative Templates → Windows Components → Windows PowerShell → Turn on PowerShell Script Block Logging.

### 4. Restrict wscript, mshta, and cscript for non-admin users

**Standard**

Block or restrict Windows Script Host interpreters for users who do not have a documented business need for them, closing the loader stage that most script-based Agent Tesla chains depend on.

**Path:** Computer Configuration → Windows Settings → Security Settings → Application Control Policies. Audit-mode rollout first.

### 5. Alert on RegAsm.exe or MSBuild.exe with network activity

**Standard**

Neither utility has a legitimate reason to open outbound network sockets on a typical endpoint. A behavioral rule flagging this combination catches the process-hollowing stage regardless of the specific loader variant in use.

**Path:** Implement via EDR custom rule correlating process image name against outbound connection events.

Controls 1—4 block delivery and execution stages. Control 5 targets the evasion and credential-access stage after initial execution. If compromise is confirmed, prioritize resetting credentials and revoking sessions for every account visible to the affected user, since Agent Tesla harvests broadly rather than targeting a single application.

## Primary references

Source material this page is built on. Last reviewed against MITRE ATT&CK (S0331), HHS HC3 advisories, and sandbox-based campaign analysis through July 2026.

- [MITRE ATT&CK — Agent Tesla, Software S0331](https://attack.mitre.org/software/S0331/) — Current
- [HHS HC3 Sector Note — Remote Access Trojan “Agent Tesla” Targets Organizations with COVID-themed Phishing Attacks](https://www.hhs.gov/sites/default/files/remote-access-trojan-agent-tesla-targets-organizations-covid-themed-phishing-attacks.pdf) — Jun 2020
- [HHS HC3 Analyst Note — PPE-Themed Phishing Campaign Exploits COVID Shortages to Spread Malware](https://www.hhs.gov/sites/default/files/agent-tesla-phishing.pdf) — Aug 2020
- [Malpedia (Fraunhofer FKIE) — Agent Tesla malware family profile and OriginLogger relationship](https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla) — Current
- [MITRE ATT&CK — Enterprise framework reference](https://attack.mitre.org/) — Current