> Family · AgentTesla_

~/packetpursuit $ cat /intel/families/agenttesla.md

typeentityfamilyagentteslaconfidencehighcreated2026-06-28updated2026-06-30malware-familyinfostealerdotnetsmtp-exfiltrationbrowser-credential-theftclipboard-hijackkeyloggerscreenshot-captureanti-vm

AgentTesla

Overview

AgentTesla is a commodity .NET-based information stealer / keylogger / RAT sold as malware-as-a-service. It has been active since at least 2014 and is frequently delivered via phishing emails with business-document lures (invoices, purchase orders, RFQs, shipping notices). The payload is typically a .NET Framework 4.x assembly that exfiltrates stolen data via SMTP, FTP, or Telegram.

This corpus currently contains one confirmed AgentTesla sample (accd2ccd), delivered via an unclassified-autoit-compiled AutoItSC single-file PE32 loader that drops an encrypted .NET payload and a shellcode intermediary.

Build Stack Typically Observed

  • Language: C# / .NET Framework 4.0–4.8
  • Compiler: MSVC 14.x (when wrapped in AutoItSC loaders) or direct MSBuild
  • Packing: Often delivered inside AutoItSC, PyInstaller, or NSIS wrappers; the inner .NET assembly is usually unobfuscated or lightly obfuscated
  • Obfuscation: Variable names may be unobfuscated (AgentTesla builder defaults); some variants use ConfuserEx or custom string encryption
  • Signing: Usually unsigned

Deploy / TTPs

  • Execution: T1059.005 (AutoIt interpreter) or T1059.003 (Windows Command Shell) via dropper
  • Credential Access: T1003 — browser credential stores (Login Data, key4.db, logins.json, signons.sqlite), Windows Credential Manager, email clients (Outlook, Thunderbird, FoxMail, Opera Mail, Mailbird, The Bat!, Eudora)
  • Collection: T1115 (clipboard), T1113 (screenshots), T1056.001 (keylogging), T1005 (local system data)
  • Discovery: T1082 (system information), T1012 (query registry), T1497.001 (anti-VM via WMI)
  • Exfiltration: T1041 via SMTP (STARTTLS/SSL), FTP, or Telegram Bot API
  • C2 Protocol: SMTP with hardcoded credentials; some variants use FTP or HTTP POST

Known C2 Patterns

  • SMTP servers are typically free/cheap hosting domains (e.g. myhydropowered.com)
  • Sender addresses are themed (e.g. versace@, buyfromarman@) — likely disposable or compromised accounts
  • Hardcoded UUID mutex for single-instance gating
  • IP geolocation checks against api.ipify.org and ip-api.com for hosting/VPS detection

Variants / Aliases

  • Delivered via unclassified-autoit-compiled AutoItSC loaders (observed in this corpus)
  • Delivered via PyInstaller droppers
  • Delivered via NSIS / Inno Setup installers
  • Raw .NET assembly with no wrapper

Notable Analyses

Currently six confirmed samples in this corpus:

|- 127c404a (Jul 2024) — AutoItSC-delivered; 15-byte XOR key K1DOQHHP0ZQDOL4, 97 KB encrypted inner .NET PE32. AgentTesla infostealer with aaalogshsindgdaLogndta log filename. Process hollowing into svchost.exe / RegSvcs.exe. No live C2 recovered statically. Static-only.^[/intel/analyses/127c404a67f2d8c1673bd85759a1875b2e87055c506d769f1b7c699dbefb50bb.html]

|- 0efed3b3 (czxyLW.exe, Jun 2024) — AutoItSC-delivered; 17-byte XOR key ZQADJ4130PGRELWJM, 240 KB inner .NET PE32. SMTP C2 mail.rrcindia.co.in with hardcoded credentials goyal@rrcindia.co.in / Goyal@0783. Secondary email zamanic62@gmail.com. IP geolocation via api.ipify.org. Browser/email/FTP/VPN/VNC/Discord credential theft, clipboard, keylogger, screenshot, Windows Vault API. Static-only.^[/intel/analyses/0efed3b303e58e99f42f522e0c357c0b42d5999db3770f8bf43513869215c472.html]

|- 6718622d (Final_order.exe, Jul 2024) — AutoItSC-delivered; XOR-decrypted inner payload. Keylogger, screenshot, clipboard, SMTP exfil. Static-only.^[/intel/analyses/6718622d94d373a123cac9f8cc6789bc1132eed19a5a9232dd0454ee869d910c.html]

  • bee6e88e (Konfirmimi_i_porosise.exe, Sep 2024) — First .NET Native AOT-compiled AgentTesla in corpus. 2.2 MB x64 PE, DotNetRuntimeDebugHeader export, encrypted BINARY resource for C2 config. Authenticode signed. Static-only.^[/intel/analyses/bee6e88e6a00d3dae465fabe3c467e48b0b461c99f726505648048db9f563935.html]

  • b017d189 (untitled, Jul 2024) — AutoItSC-delivered; 30-byte XOR key, 268 KB inner .NET PE32. SMTP/FTP/HTTP exfil. Static-only.^[/intel/analyses/b017d1897d3c5b5c51f02fafcbe48700943ebe0921c1c881d4f7ea37fe1eefdc.html]

  • accd2ccd (PO-22012025-RFQ.exe, Oct 2024) — AutoItSC-delivered with SMTP C2 mail.myhydropowered.com. WMI anti-VM. Static-only.^[/intel/analyses/accd2ccd2be48b4303154bb87f87d0d6897441c18ca7b16b22fbaa8b68bbacbb.html]

  • 0ce2a9be (Jul 2026) — First Delphi VCL native stub → raw .NET metadata delivery in corpus. Borland Delphi VCL PE32 with DVCLAL/PACKAGEINFO resources. Overlay at 0xA200 contains raw .NET metadata (no PE header) for AgentTesla .NET Framework 4.x assembly. Stub XOR-decrypts overlay, writes temp file with FILE_ATTRIBUTE_HIDDEN, launches via WinExec. Browser/email/FTP/VNC/Discord credential theft, clipboard, keylogger, screenshot, Windows Vault API, SMTP/Tor exfil. No live C2 recovered statically. Static-only.^[/intel/analyses/0ce2a9bef251a42648a4ef198c4da7cb4c707b9635b13036d3d552fc87ac1566.html]

Related Entities and Concepts

Capabilities

  • agenttesla-shellcode-xor-decryptor
  • agenttesla-reflective-dotnet-load
  • agenttesla-native-aot-compilation
  • agenttesla-custom-binary-resource-encrypted-config
  • agenttesla-delphi-vcl-raw-metadata-loader
  • smtp-c2-exfiltration
  • browser-credential-harvesting
  • email-client-credential-theft
  • ftp-client-credential-theft
  • vpn-client-credential-theft
  • clipboard-monitoring
  • keylogging
  • screenshot-capture
  • anti-vm-wmi-queries
  • ip-geolocation-check
  • mutex-single-instance-gating
  • windows-credential-manager-dump
  • discord-token-theft
  • native-aot-anti-analysis
  • version-info-masquerade
  • vnc-client-credential-theft — TightVNC, TigerVNC, UltraVNC, RealVNC control/view-only passwords; first observed in sample 0efed3b3