AgentTesla .NET Infostealer

Overview

AgentTesla is a commodity .NET Framework information stealer sold as malware-as-a-service. It targets browser credentials, clipboard data, keystrokes, screenshots, and email client credentials, exfiltrating via SMTP, FTP, or Telegram. In this corpus, it is most commonly delivered inside an AutoItSC single-file PE32 wrapper that drops an encrypted payload and a shellcode intermediary.

Capabilities

• browser-credential-harvesting — Chrome, Firefox, Edge, Opera, Yandex credential stores (Login Data, key4.db, logins.json)
• email-client-credential-theft — Outlook, Thunderbird, FoxMail, Mailbird, The Bat!, Eudora
• keylogging — SetWindowsHookExA WH_KEYBOARD_LL hook
• clipboard-monitoring — GetClipboardData / OpenClipboard
• screenshot-capture — CopyFromScreen / System.Drawing
• windows-credential-manager-dump — CryptUnprotectData on credential blobs
• smtp-exfiltration — hardcoded SMTP credentials, typically free/cheap hosting domains
• ftp-exfiltration — FtpWebRequest with hardcoded credentials
• http-exfiltration — HttpWebRequest POST to panels or Telegram Bot API
• anti-vm-wmi-queries — SELECT * FROM Win32_ComputerSystem for manufacturer/model checks
• ip-geolocation-check — queries api.ipify.org and ip-api.com for hosting/VPS detection
• mutex-single-instance-gating — UUID-based mutex to prevent multiple infections

Delivery in This Corpus

AgentTesla is rarely the outer layer. In this corpus, delivery chains follow this pattern:

1. Phishing email → business-document lure (invoice, RFQ, PO, shipping notice).
2. AutoItSC PE32 → compiled AutoIt script drops encrypted payload + shellcode.
3. Shellcode → decoded, allocated RWX, executed at 0x23b0 via DllCallAddress.
4. Shellcode → XOR-decrypts inner payload, process-hollows svchost.exe or RegSvcs.exe.
5. AgentTesla → .NET assembly runs inside the hollowed process, harvesting and exfiltrating.

Notable Analyses in Corpus

• 0efed3b3 — SMTP C2 mail.rrcindia.co.in, credentials goyal@rrcindia.co.in / Goyal@0783. 17-byte XOR key.
• 6718622d — 19-byte XOR key, .NET inner payload with aaalogshsindgdaLogndta log file.
• b017d189 — 30-byte XOR key, 268 KB inner .NET PE32, SMTP/FTP/HTTP exfil.
• accd2ccd — SMTP C2 mail.myhydropowered.com, WMI anti-VM.
• 127c404a — 15-byte XOR key K1DOQHHP0ZQDOL4, inner payload SHA-256 8145724e..., same aaalogshsindgdaLogndta log filename. Primary target svchost.exe, fallback RegSvcs.exe.

Related

• agenttesla — entity page (broader family context)
• unclassified-autoit-compiled — delivery mechanism cluster
• process-hollowing-svchost-regsvcs — injection technique
• smtp-exfiltration — exfiltration channel
• browser-credential-harvesting — collection technique