AgentTesla

Overview

AgentTesla is a commodity .NET-based information stealer / keylogger / RAT sold as malware-as-a-service. It has been active since at least 2014 and is frequently delivered via phishing emails with business-document lures (invoices, purchase orders, RFQs, shipping notices). The payload is typically a .NET Framework 4.x assembly that exfiltrates stolen data via SMTP, FTP, or Telegram.

This corpus currently contains one confirmed AgentTesla sample (accd2ccd), delivered via an unclassified-autoit-compiled AutoItSC single-file PE32 loader that drops an encrypted .NET payload and a shellcode intermediary.

Build Stack Typically Observed

• Language: C# / .NET Framework 4.0–4.8
• Compiler: MSVC 14.x (when wrapped in AutoItSC loaders) or direct MSBuild
• Packing: Often delivered inside AutoItSC, PyInstaller, or NSIS wrappers; the inner .NET assembly is usually unobfuscated or lightly obfuscated
• Obfuscation: Variable names may be unobfuscated (AgentTesla builder defaults); some variants use ConfuserEx or custom string encryption
• Signing: Usually unsigned

Deploy / TTPs

• Execution: T1059.005 (AutoIt interpreter) or T1059.003 (Windows Command Shell) via dropper
• Credential Access: T1003 — browser credential stores (Login Data, key4.db, logins.json, signons.sqlite), Windows Credential Manager, email clients (Outlook, Thunderbird, FoxMail, Opera Mail, Mailbird, The Bat!, Eudora)
• Collection: T1115 (clipboard), T1113 (screenshots), T1056.001 (keylogging), T1005 (local system data)
• Discovery: T1082 (system information), T1012 (query registry), T1497.001 (anti-VM via WMI)
• Exfiltration: T1041 via SMTP (STARTTLS/SSL), FTP, or Telegram Bot API
• C2 Protocol: SMTP with hardcoded credentials; some variants use FTP or HTTP POST

Known C2 Patterns

• SMTP servers are typically free/cheap hosting domains (e.g. myhydropowered.com)
• Sender addresses are themed (e.g. versace@, buyfromarman@) — likely disposable or compromised accounts
• Hardcoded UUID mutex for single-instance gating
• IP geolocation checks against api.ipify.org and ip-api.com for hosting/VPS detection

Variants / Aliases

• Delivered via unclassified-autoit-compiled AutoItSC loaders (observed in this corpus)
• Delivered via PyInstaller droppers
• Delivered via NSIS / Inno Setup installers
• Raw .NET assembly with no wrapper

Notable Analyses

Currently six confirmed samples in this corpus:

||- 127c404a (Jul 2024) — AutoItSC-delivered; 15-byte XOR key K1DOQHHP0ZQDOL4, 97 KB encrypted inner .NET PE32. AgentTesla infostealer with aaalogshsindgdaLogndta log filename. Process hollowing into svchost.exe / RegSvcs.exe. No live C2 recovered statically. Static-only.^[/intel/analyses/127c404a67f2d8c1673bd85759a1875b2e87055c506d769f1b7c699dbefb50bb.html]

||- 0efed3b3 (czxyLW.exe, Jun 2024) — AutoItSC-delivered; 17-byte XOR key ZQADJ4130PGRELWJM, 240 KB inner .NET PE32. SMTP C2 mail.rrcindia.co.in with hardcoded credentials goyal@rrcindia.co.in / Goyal@0783. Secondary email zamanic62@gmail.com. IP geolocation via api.ipify.org. Browser/email/FTP/VPN/VNC/Discord credential theft, clipboard, keylogger, screenshot, Windows Vault API. Static-only.^[/intel/analyses/0efed3b303e58e99f42f522e0c357c0b42d5999db3770f8bf43513869215c472.html]

||- 6718622d (Final_order.exe, Jul 2024) — AutoItSC-delivered; XOR-decrypted inner payload. Keylogger, screenshot, clipboard, SMTP exfil. Static-only.^[/intel/analyses/6718622d94d373a123cac9f8cc6789bc1132eed19a5a9232dd0454ee869d910c.html]

|- bee6e88e (Konfirmimi_i_porosise.exe, Sep 2024) — First .NET Native AOT-compiled AgentTesla in corpus. 2.2 MB x64 PE, DotNetRuntimeDebugHeader export, encrypted BINARY resource for C2 config. Authenticode signed. Static-only.^[/intel/analyses/bee6e88e6a00d3dae465fabe3c467e48b0b461c99f726505648048db9f563935.html]

|- b017d189 (untitled, Jul 2024) — AutoItSC-delivered; 30-byte XOR key, 268 KB inner .NET PE32. SMTP/FTP/HTTP exfil. Static-only.^[/intel/analyses/b017d1897d3c5b5c51f02fafcbe48700943ebe0921c1c881d4f7ea37fe1eefdc.html]

|- accd2ccd (PO-22012025-RFQ.exe, Oct 2024) — AutoItSC-delivered with SMTP C2 mail.myhydropowered.com. WMI anti-VM. Static-only.^[/intel/analyses/accd2ccd2be48b4303154bb87f87d0d6897441c18ca7b16b22fbaa8b68bbacbb.html]

|- 0ce2a9be (Jul 2026) — First Delphi VCL native stub → raw .NET metadata delivery in corpus. Borland Delphi VCL PE32 with DVCLAL/PACKAGEINFO resources. Overlay at 0xA200 contains raw .NET metadata (no PE header) for AgentTesla .NET Framework 4.x assembly. Stub XOR-decrypts overlay, writes temp file with FILE_ATTRIBUTE_HIDDEN, launches via WinExec. Browser/email/FTP/VNC/Discord credential theft, clipboard, keylogger, screenshot, Windows Vault API, SMTP/Tor exfil. No live C2 recovered statically. Static-only.^[/intel/analyses/0ce2a9bef251a42648a4ef198c4da7cb4c707b9635b13036d3d552fc87ac1566.html]

||- 387da5ed (BL DOCUMENTS.JS, Jul 2026) — First JScript dropper in this corpus. 3.2 MB javascript-obfuscator obfuscated JScript (BL DOCUMENTS.JS) masquerading as a business document. Builds a PowerShell command via obfuscated string-array lookups, reconstructs payload through >-padded fragments stripped at runtime, and instantiates ActiveXObject with Open()/Write() methods consistent with ADODB.Stream/Scripting.FileSystemObject staging. Debugger trap via while(true){} constructor pattern. No C2 or secondary payload recovered statically — requires sandbox execution. Static-only. Medium-confidence family attribution pending dynamic confirmation.^[/intel/analyses/387da5edf39457b69f654637feb52e35be921ce99e7b5f39ebdbcaf77637f61c.html]

||- 8c1d87fd (PO 012447.JS, Aug 2026) — Second confirmed JScript dropper; structural twin of 387da5ed with identical javascript-obfuscator build fingerprints, same siderophyre PowerShell cradle variable, same noise-bloat pattern (~2.4 MB dead-string concatenation), and same ActiveXObject staging. Only deltas are noise token (VMIOCMXABMRWDUZALRZJYJOAVHNKAVC vs RMKTDQTABZJLZWTBXSSBXRKIDGCMMIC) and filename lure (PO 012447.JS vs BL DOCUMENTS.JS). Real payload hidden in a single 2.5 MB line (line 55 of 104). Static-only. Medium-confidence family attribution.^[/intel/analyses/8c1d87fd44657fef556790d40f427921fe10eddf40f9edd6a58d68687286ea9d.html]

||- 6bd72078 (origin.exe, Jan 2024) — Naked .NET PE32, no wrapper (no AutoItSC, no Delphi, no PyInstaller). Builder-default unobfuscated method names (EnableKeylogger, EnableClipboardLogger, VaultEnumerateVaults, FtpHost, PublicIpAddressGrab). Version-info masquerade as Python 3.11.3 (64-bit) / Python Software Foundation / setup. FTP/HTTP/WebClient exfil channels, Tor panel option, clipboard/keylogger/screenshot/browser-credential/Vault-API theft. No hardcoded C2 recovered statically. Static-only.^[/intel/analyses/6bd7207841fad8f065ae5ea7f71082e4625ebbacbfbd5c836c88a12024c379fb.html]

Related Entities and Concepts

• unclassified-autoit-compiled — delivery mechanism cluster
• autoit-compiled-script-dropper — concept page for AutoIt delivery patterns
• smtp-exfiltration — exfiltration channel
• browser-credential-harvesting — primary collection behaviour
• clipboard-hijack-cryptocurrency — related clipboard-stealing behaviour (not observed in this AgentTesla sample, but common in the family)
• telegram-bot-exfiltration — alternative exfil channel used by some AgentTesla variants

Capabilities

• agenttesla-shellcode-xor-decryptor
• agenttesla-reflective-dotnet-load
• agenttesla-native-aot-compilation
• agenttesla-custom-binary-resource-encrypted-config
• agenttesla-delphi-vcl-raw-metadata-loader
• smtp-c2-exfiltration
• browser-credential-harvesting
• email-client-credential-theft
• ftp-client-credential-theft
• vpn-client-credential-theft
• clipboard-monitoring
• keylogging
• screenshot-capture
• anti-vm-wmi-queries
• ip-geolocation-check
• mutex-single-instance-gating
• windows-credential-manager-dump
• discord-token-theft
• native-aot-anti-analysis
• version-info-masquerade
• vnc-client-credential-theft — TightVNC, TigerVNC, UltraVNC, RealVNC control/view-only passwords; first observed in sample 0efed3b3
• agenttesla-jscript-obfuscator-dropper — javascript-obfuscator npm JScript loader with PowerShell cradle and ActiveXObject staging; first observed in sample 387da5ed
• agenttesla-javascript-obfuscator-dead-code-bloat — 2.4 MB dead-string concatenation to evade static extraction and size heuristics
• agenttesla-javascript-debugger-trap — Function.prototype.constructor('while(true){}') anti-debug
• agenttesla-naked-dotnet-direct-execution — Raw .NET PE32 with no wrapper, builder-default unobfuscated method names; first observed in sample 6bd72078
• agenttesla-python-masquerade-version-info — VS_VERSIONINFO masquerade as Python 3.11.3 (64-bit) / Python Software Foundation; first observed in sample 6bd72078