Home

Agent Tesla

Spyware / RAT (MaaS) · First seen 2014

Overview

Agent Tesla is a .NET-based spyware Trojan and remote access tool that has been sold as malware-as-a-service since at least 2014. MITRE ATT&CK tracks it as software S0331 and links its use to the SilverTerrier Nigerian business-email-compromise cluster and the phishing group TA2541. It is one of the longest-running commodity keyloggers still in active distribution, and its leaked builder has spawned a direct successor, OriginLogger, which reuses Agent Tesla's code and configuration handling so closely that many Agent Tesla detection rules still catch it.

Agent Tesla is not a ransomware precursor loader in the way some infostealers are. It is a self-contained keylogger and credential harvester built around a single subscription-based builder. Affiliates configure their own phishing lure, C2 channel, and exfiltration protocol, then distribute the resulting binary independently. This makes every Agent Tesla sample slightly different at the byte level while the underlying behavior, credential harvesting, keystroke logging, screenshot capture, and mail/HTTP/FTP/Telegram exfiltration, stays consistent across builds.

The malware's staying power comes from low barrier to entry rather than technical novelty. HHS's Health Sector Cybersecurity Coordination Center documented Agent Tesla campaigns exploiting Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2017-8570 during a 2020 wave of COVID and PPE-themed phishing; the underlying exploitation and phishing patterns are still in use, with only the thematic wrapper changing. Recent campaign reporting from sandbox analysis describes business-document lures, purchase orders, invoices, payroll files, and procurement requests, replacing the pandemic-era themes.

Agent Tesla is not used for lateral movement or ransomware deployment. It is a single-host credential and surveillance tool. Its downstream risk comes from what happens to the harvested data: stolen mailbox and VPN credentials feed business email compromise, and law enforcement action, including Interpol arrests tied to Agent Tesla-assisted financial crime, has repeatedly connected the malware to BEC fraud rings operating out of West Africa.

Operational attack chain · Phishing-to-Agent Tesla

  1. Phishing email

    Invoice, purchase order, or payroll lure.

  2. Attachment opened

    RAR, ISO, macro doc, or RTF exploit.

  3. JScript / VBS loader

    wscript / mshta hands off to PowerShell.

  4. In-memory .NET loader

    Reflective load. No disk write of the payload.

  5. Process hollowing

    RegAsm.exe / MSBuild.exe launched suspended, then hollowed.

  6. Credentials harvested

    Browser, mail, FTP, Wi-Fi, keystrokes, screenshots, clipboard.

  7. Exfil to attacker

    SMTP / HTTP / FTP / Telegram. Feeds mailbox takeover and BEC fraud.

    BECSilverTerrier

Agent Tesla does not require an exploit to execute. Where CVE-2017-11882/CVE-2017-8570 exploitation is absent, affiliates substitute macro-enabled documents or script loaders that rely entirely on user execution, so the same kill chain plays out with or without a vulnerable Office build.

Source: MITRE ATT&CK (S0331), HHS HC3, sandbox campaign analysis, 2020—2026

Stop threats before they spread

Detect malicious behavior, contain affected endpoints, and remediate attacks with Malware Protection Plus.

Free for 30 days. Unlimited endpoints. No credit card required.

Sign up

Tactics, techniques, and procedures

Agent Tesla maps to MITRE ATT&CK Enterprise techniques spanning initial access through exfiltration, with the highest density in Discovery, Credential Access, and Collection.

MITRE ATT&CK coverageHeavyActiveNot observed
Recon0Resource Dev0Initial Access1Execution2Persistence2Priv. Esc0Defense Evasion8Credential Access5Discovery3Lateral0Collection3C22Exfiltration1Impact0
Technique detailKey techniques · Agent Tesla
TacticTechniquesWhat Agent Tesla does
Initial Access
Spearphishing Attachment T1566.001
Business-themed emails carrying invoice, purchase-order, payroll, or procurement lures. Opening the attachment is the execution mechanism.
Execution
Exploitation for Client Execution T1203Malicious File T1204.002
CVE-2017-11882 / CVE-2017-8570 when Office is unpatched; otherwise a macro-enabled document, RTF, or script loader inside a RAR, ZIP, or ISO. No exploit is required.
Persistence
Registry Run Keys T1547.001Scheduled Task T1053.005
Registry Run keys or scheduled tasks, affiliate-configured. Many campaigns skip persistence — a keylogger only needs one login session.
Defense Evasion
Obfuscated Files T1027Deobfuscate / Decode T1140Sandbox Evasion T1497Process Hollowing T1055.012Regsvcs / Regasm T1218.009Hidden Files T1564.001Hidden Window T1564.003Disable or Modify Tools T1685
Rijndael-encrypted strings decoded only at runtime. Payload hollows RegAsm.exe or MSBuild.exe, hides windows, and can terminate analysis or security processes it finds running.
Credential Access
Credentials from Browsers T1555.003Password Stores T1555Credentials in Files T1552.001Credentials in Registry T1552.002Keylogging T1056.001
Harvests browser, mail, and FTP credentials, plus Wi-Fi passwords via netsh wlan show profile … key=clear. Keylogs in real time and form-grabs data before TLS protects it.
Discovery
Wi-Fi Discovery T1016.002Process Discovery T1057System Information T1082
Enumerates saved wireless profiles, running processes, and WMI virtualization identifiers (VMware, VirtualBox, Hyper-V) before collecting anything.
Collection
Screen Capture T1113Clipboard Data T1115Archive Collected Data T1560
Periodic desktop screenshots, clipboard monitoring, and in some builds webcam video. Collected material is archived and encrypted with 3DES before transmission.
Command and Control
Web Protocols T1071.001Mail Protocols T1071.003
Builder-configurable SMTP, HTTP, FTP, or Telegram Bot API. SMTP to an external mail relay has historically been the most common channel.
Exfiltration
Exfil Over Unencrypted Non-C2 T1048.003
Stolen data leaves over the configured channel — SMTP, HTTP POST, FTP upload, or Telegram sendDocument / sendMessage — straight to the attacker.
Recon / Resource Dev / Priv Esc / Lateral / Impact—Not observed. Agent Tesla is a single-host credential and surveillance tool; it is not used for lateral movement or ransomware deployment.
Stage 1T1566.001 · T1203 · T1204.002

How the attack starts

Agent Tesla's entry point has stayed the same since 2014: an email that looks like ordinary business correspondence. HHS HC3 documented a PPE-themed wave in 2020 that rotated IP addresses and sample hashes on a 10-day cycle while keeping the email body text nearly identical, an operational pattern of thematic disposability that persists today. Current campaigns replace pandemic themes with invoices, purchase orders, payroll notices, and procurement requests aimed at employees who routinely handle external files and supplier communication.

The attachment vector varies by build. MITRE documents exploitation of the Office Equation Editor vulnerabilities CVE-2017-11882 and CVE-2017-8570 for silent execution when the target has an unpatched Office install. Where the target is patched, affiliates fall back to macro-enabled Word or PowerPoint documents, RTF files, or password-protected archives (RAR, ZIP, ISO) containing a script loader. Both paths converge on the same downstream chain once the initial file executes.

No exploit is strictly required. A macro-enabled document or a script loader inside an archive achieves the same outcome as an unpatched Office exploit: it converts the recipient into the execution mechanism. This is why attachment-opening behavior and script-interpreter telemetry matter as much as patch status when scoping detection coverage.

Stage 2T1204.002 · T1547.001 · T1053.005 · T1218.009

What runs on the endpoint

A representative execution chain observed across multiple Agent Tesla campaigns runs: RAR or ISO attachment, a JScript or VBScript loader (.jse/.vbs), a first PowerShell stage that downloads a second obfuscated PowerShell stage, which reflectively loads a .NET loader assembly entirely in memory, which in turn decrypts and loads the final Agent Tesla payload. No stage after the initial script needs to touch disk as an unpacked executable.

The final payload does not run as its own visible process. MITRE documents Agent Tesla dropping RegAsm.exe onto systems and using process hollowing to execute inside it: a legitimate .NET utility is launched in a suspended state, its memory is cleared, and the Agent Tesla payload is written into the hollowed space before the thread resumes. MSBuild.exe is used the same way in other builds. Because the process name on screen is a signed Microsoft utility, static allow-listing and signature checks alone will not flag it.

Persistence is affiliate-configured rather than universal. Agent Tesla can add itself to Registry Run keys to survive reboot, or establish a scheduled task. A meaningful share of campaigns skip persistence altogether: a keylogger only needs to survive long enough to capture one login session, so some affiliates prioritize stealth over durability.

Stage 3T1027 · T1140 · T1497 · T1055.012 · T1564.001 · T1564.003 · T1685

How the malware evades detection

Every stage of the loader chain is obfuscated. Agent Tesla encrypts strings with the Rijndael symmetric algorithm and decrypts them only at runtime, so static string scanning of the on-disk artifact reveals little. Layered packing means the true .NET payload is only exposed after several stages of in-memory decoding.

Before collecting anything, the payload checks whether it is being watched. Agent Tesla performs anti-sandbox and anti-virtualization checks, commonly by querying WMI for indicators of VMware, VirtualBox, or Hyper-V, and by looking for DLLs associated with analysis tooling and lightweight sandboxes loaded into its own process. If it finds them, some builds terminate immediately rather than reveal behavior to an analyst.

Process hollowing (T1055.012) is the core evasion mechanic once the payload is ready to run persistently: launching a trusted .NET binary suspended, replacing its memory, and resuming it means the visible process name, signature, and parent lineage all look legitimate. Agent Tesla also creates hidden folders and runs child processes with ProcessWindowStyle.Hidden so no window ever appears to the user, and it can enumerate and terminate analysis or security processes it detects running (T1685).

Stage 4T1555.003 · T1555 · T1552.001 · T1552.002 · T1056.001 · T1113 · T1115 · T1560

What it tries to access or modify

Agent Tesla's core objective is credential and surveillance data, not encryption or destruction. It gathers credentials from a broad set of browsers, and separately extracts credentials stored by FTP clients and saved wireless network profiles. Wi-Fi credentials are pulled by spawning netsh.exe with a show profile … key=clear argument, which forces Windows to display the stored password in plaintext for each saved SSID. Credentials left behind in configuration files or written into the Registry by other applications are extracted directly (T1552.001, T1552.002).

Beyond stored secrets, the malware actively monitors the user in real time. It logs every keystroke, captures periodic screenshots of the desktop, and in some builds records webcam video. It also monitors the clipboard and uses form-grabbing to intercept data as it is typed into web forms, before browser-native encryption or TLS ever protects it. Collected material is archived and encrypted with 3DES prior to transmission, which is a confidentiality measure for the attacker, not an evasion technique against the endpoint.

What makes this collection dangerous for defenders is not any single API call. It is a process with no legitimate reason to touch Login Data, logins.json, an FTP client's saved-site file, and the keyboard input stream all within the same session, shortly after a script-driven execution chain. Each access is individually plausible; the combination is not.

Process tree

What the kill chain looks like in EDR telemetry

Where Malware Protection Plus fits

A walkthrough showing detection of the script-to-hollowed-process execution chain, automated containment of the affected endpoint, and forensic capture of exfiltration artifacts.

Agent Tesla's evasion depends on looking like a trusted process. Endpoint security teams should monitor for the sequence rather than any single artifact: a script interpreter spawning PowerShell, PowerShell reflectively loading a .NET assembly, and a normally quiet utility like RegAsm.exe or MSBuild.exe suddenly reading browser credential stores and opening outbound SMTP or HTTP connections it has no legitimate reason to make.

Malware Protection Plus helps security teams detect this kind of suspicious endpoint behavior, isolate the affected system before harvested credentials leave the network, investigate the root cause across the phishing-to-hollowed-process chain, and support faster remediation and restoration of the endpoint.

Indicators of compromise

Agent Tesla is built per affiliate from a shared builder, so hashes, C2 domains, and lure filenames rotate constantly. Indicators below are separated into durable behavioral patterns that survive variant rotation, and volatile indicators that expire quickly and should be treated as short-lived hunting leads.

File and process artifacts

Durable

Behavioral artifacts that survive variant rotation. Hashes and lure names do not.

  • RegAsm.exe / MSBuild.exe with network socketsNeither utility legitimately opens outbound connections
  • HKCU\...\CurrentVersion\Run [random name]Persistence, when affiliate-configured
  • HKLM\...\TaskCache\Tasks [new task]Scheduled task persistence variant
  • netsh.exe wlan show profile [SSID] key=clearPlaintext Wi-Fi credential extraction

Process tree patterns

Durable

Parent-child execution chains that signal a phishing-to-Agent Tesla kill chain in progress.

  • outlook.exe / winword.exe → wscript.exe / mshta.exeOffice/mail client spawning script interpreters
  • wscript.exe → powershell.exe -enc [base64]Script loader to encoded PowerShell stage
  • powershell.exe → RegAsm.exe (suspended, then hollowed)Process hollowing into a signed .NET utility
  • [hollowed utility] → Login Data / logins.json / FTP configCredential store read from a non-browser, non-client process

Infrastructure

Volatile

Expires quickly. Treat as short-lived hunting leads, not durable detections.

  • File hashes (unique per builder output)Every affiliate build produces distinct hashes
  • C2 mail relay / HTTP panel domain or IPRotates per campaign and per affiliate
  • Phishing sender address / subject lineHistorically rotated on roughly a 10-day cycle
  • Attachment filename (invoice / PO / payroll)Theme rotates with current events and industry

Network behavior

Volatile

Outbound traffic patterns that rotate with each affiliate's C2 configuration.

  • api.telegram.org sendDocument / sendMessageTelegram Bot API from a non-Telegram process
  • Outbound SMTP from a non-mail-client processHistorically the most common exfil channel for this family
  • FTP upload to an unfamiliar external hostLegacy exfil channel, still configurable

Detection guidance

Static, hash-based scanning is a poor fit for Agent Tesla because the builder produces a unique binary per affiliate. What defenders can detect reliably is the sequence: a script interpreter spawned from an email client, followed by encoded PowerShell, followed by a hollowed system utility that suddenly touches credential stores and opens outbound connections it has no reason to make.

  1. 01

    Office/mail client spawning script interpreters

    Endpoint telemetry

    What to monitor: outlook.exe, winword.exe, or powerpnt.exe spawning wscript.exe, cscript.exe, or mshta.exe, especially where the script file originated from a recently opened email attachment or extracted archive.

    Why it works: legitimate business documents do not spawn script interpreters. This parent-child relationship is the earliest reliable signal in the chain.

  2. 02

    Encoded or downloaded PowerShell stages

    Script block logging

    What to monitor: PowerShell invoked with -enc/-EncodedCommand, or making an outbound web request to fetch a second-stage script, followed by reflective assembly loading (Assembly.Load patterns in script block logs).

    Why it works: reflective in-memory loading is the mechanism that keeps the final .NET payload off disk. Script block logging captures the command before it self-obfuscates further.

  3. 03

    Process hollowing into RegAsm.exe or MSBuild.exe

    EDR / memory telemetry

    What to monitor: a .NET utility launched in a suspended state, followed by memory writes into that process from a different parent, followed by resumption. Also flag either binary if it later opens network sockets or file handles to browser profile directories.

    Why it works:RegAsm.exe and MSBuild.exe have no legitimate reason to make outbound network connections or read browser credential stores. Any instance doing so should be treated as compromised.

  4. 04

    Sandbox and VM fingerprinting queries

    WMI / API telemetry

    What to monitor: WMI queries for virtualization indicators (VMware, VirtualBox, Hyper-V identifiers) or process/module enumeration checking for known analysis-tool DLLs, issued by a freshly spawned, unsigned or hollowed process.

    Why it works: this behavior has no purpose for a legitimate application. Its presence right after a script-execution chain is a strong evasion-stage signal, though it also appears in benign inventory and licensing tools, so correlate rather than alert in isolation.

  5. 05

    Credential store access from a non-owning process

    File access telemetry

    What to monitor: reads of browser Login Data, Firefox logins.json/key4.db, FTP client site configuration files, or saved mail client credentials by any process other than the application that owns them.

    Why it works: browsers, FTP clients, and mail clients read their own credential stores; nothing else should. A hollowed system utility reading these files is unambiguous.

  6. 06

    Anomalous outbound SMTP, FTP, or Telegram Bot API traffic

    Firewall / DLP / proxy logs

    What to monitor: outbound SMTP connections to unfamiliar external relays from a non-mail-client process, FTP uploads to unfamiliar hosts, or HTTPS requests to api.telegram.org endpoints (sendDocument, sendMessage) originating from a process other than the Telegram desktop or web client.

    Why it works: each channel is a single-purpose tell. Telegram Bot API traffic in particular has a narrow, well-defined legitimate use case, making unexpected callers easy to isolate once a baseline exists.

Hardening recommendations

The controls below reduce the attack surface Agent Tesla depends on: macro execution, unpatched Office builds, and unrestricted script interpreters. Quick win = single GPO or rule, deployable in days. Standard = needs audit-mode rollout, deployable in weeks.

  1. Block macros in documents from the internet

    Quick win

    Configure Office to block macros in files carrying the Mark of the Web by default, removing the most common non-exploit execution path for this family.

    Path: User Configuration → Administrative Templates → Microsoft Office → Security Settings → Block macros from running in Office files from the internet.

  2. Patch Office against CVE-2017-11882 and CVE-2017-8570

    Quick win

    These Equation Editor vulnerabilities remain in active use by Agent Tesla campaigns years after patches were released. Confirm all Office installs, including legacy or unmanaged endpoints, are current.

    Verify: Confirm Office update channel status and Equation Editor (EQNEDT32.EXE) patch level across managed endpoints.

  3. Enable PowerShell script-block logging

    Quick win

    Script-block logging captures the encoded and downloaded PowerShell stages before they decode and reflectively load the .NET payload, closing the visibility gap that pure process-name monitoring misses.

    Path: Computer Configuration → Administrative Templates → Windows Components → Windows PowerShell → Turn on PowerShell Script Block Logging.

  4. Restrict wscript, mshta, and cscript for non-admin users

    Standard

    Block or restrict Windows Script Host interpreters for users who do not have a documented business need for them, closing the loader stage that most script-based Agent Tesla chains depend on.

    Path: Computer Configuration → Windows Settings → Security Settings → Application Control Policies. Audit-mode rollout first.

  5. Alert on RegAsm.exe or MSBuild.exe with network activity

    Standard

    Neither utility has a legitimate reason to open outbound network sockets on a typical endpoint. A behavioral rule flagging this combination catches the process-hollowing stage regardless of the specific loader variant in use.

    Path: Implement via EDR custom rule correlating process image name against outbound connection events.

Primary references

Source material this page is built on. Last reviewed against MITRE ATT&CK (S0331), HHS HC3 advisories, and sandbox-based campaign analysis through July 2026.

Test your defenses against phishing-to-Agent Tesla kill chains.

Malware Protection Plus helps security teams detect suspicious endpoint behavior, isolate compromised systems, investigate root cause, and restore affected endpoints faster.

Start free trial →