# Agent Tesla .NET Remote Access Trojan — Credential and Data Theft via Keylogging and MaaS Operations

> Agent Tesla is a .NET-based Remote Access Trojan and information stealer sold as Malware-as-a-Service since 2014. It harvests credentials from 80+ browsers, email, FTP, VPN and Wi-Fi clients, logs keystrokes via SetWindowsHookEx, captures screenshots and webcam video, and exfiltrates stolen data over SMTP, FTP, HTTP, and Telegram. It is delivered through spear-phishing attachments and multi-stage, fileless, process-hollowing infection chains.

- **Published:** 2026-06-23T00:00:00Z
- **Last reviewed:** 2026-06-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0912
- **ID:** TL-2026-0912
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2017-11882, CVE-2017-8570

## Description

Agent Tesla is one of the most prevalent commodity Remote Access Trojans (RATs) in circulation, first observed in late 2014 and continuously developed and resold as Malware-as-a-Service (MaaS) on dark-web forums. Built on the Microsoft .NET framework, it functions primarily as a keylogger and information stealer while retaining full RAT capabilities including remote command execution, file download, screen capture, and webcam access.

Initial access is overwhelmingly achieved through spear-phishing emails carrying malicious attachments. Over its lifetime the delivery vehicle has evolved from macro-enabled Word documents and Microsoft Office equation-editor exploits (CVE-2017-11882, CVE-2017-8570) to OLE objects, batch scripts in archives, and most recently compiled HTML Help (.chm) files and JScript (.jse) loaders packaged inside RAR/GZ archives. A representative 2026 multi-stage chain analyzed by FortiGuard Labs proceeds: email > RAR attachment > JScript (.jse) loader > downloaded PowerShell > in-memory PowerShell > in-memory .NET loader > .NET Agent Tesla payload, with the final payload injected via process hollowing into a legitimate signed .NET binary such as Aspnet_compiler.exe or RegAsm.exe.

The loader chain is heavily obfuscated (Obfuscar, Rijndael/AES-CBC PKCS7 string and payload encryption, Base64-encoded assemblies) and largely fileless — payloads are reflectively loaded into memory rather than written to disk. Anti-analysis routines detect virtualization (VMware, VirtualBox, Hyper-V) and scan for sandbox/EDR DLLs (snxhk.dll, SbieDll.dll, cmdvrt32.dll) before detonation.

Once running, Agent Tesla establishes persistence via Registry Run keys, the Startup folder, Winlogon Shell/Load values, and scheduled tasks (Schtasks.exe /Create). It performs broad system reconnaissance (WMI 'select * from win32_operatingsystem', username, computer name, OS, CPU, RAM, video card), collects Wi-Fi profiles via 'netsh wlan show profile', captures keystrokes through SetWindowsHookEx (logging to %temp%\log.tmp), grabs clipboard contents, takes desktop screenshots, and records webcam video. It steals stored credentials from 80+ applications — Chrome, Firefox, Edge, Brave, Opera, Vivaldi and other Chromium browsers, Outlook, Thunderbird, Mailbird, FileZilla, WinSCP, OpenVPN, NordVPN — by parsing SQLite stores, configuration files, and Registry entries.

Harvested data is archived (3DES/encryption), formatted into CO_/SC_/KL_ prefixed files, and exfiltrated over hardcoded SMTP (TLS, port 587), FTP (STOR with embedded credentials), HTTP, or Telegram Bot API. Telegram has become a dominant C2 channel: Agent Tesla accounted for roughly three-quarters of Telegram-C2 malware samples observed in 2024. Stolen data flows to attacker-controlled mail servers such as mail.taikei-rmc-co.biz, whose bounce traffic betrays large-scale exfiltration operations. Agent Tesla remains a top-10 malware family (Q4 2025, CIS MS-ISAC) and primarily targets the United States, China, Germany, and the global education sector.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1112 Modify Registry
- T1564 Hide Artifacts
- T1497 Virtualization/Sandbox Evasion
- T1218 System Binary Proxy Execution
- T1685 Disable or Modify Tools
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1056 Input Capture
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1057 Process Discovery
- T1033 System Owner/User Discovery
- T1113 Screen Capture
- T1125 Video Capture
- T1115 Clipboard Data
- T1185 Browser Session Hijacking
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1048 Exfiltration Over Alternative Protocol

## Sources

- [Agent Tesla Malware Analysis: How This .NET RAT Steals Your Data](https://www.picussecurity.com/resource/blog/agent-tesla-malware-analysis-how-this-.net-rat-steals-your-data)
- [Agent Tesla, Software S0331 | MITRE ATT&CK](https://attack.mitre.org/software/S0331/)
- [Agent Tesla | Old RAT Uses New Tricks to Stay on Top](https://www.sentinelone.com/labs/agent-tesla-old-rat-uses-new-tricks-to-stay-on-top/)
- [Inside the Mind of a 'Rat' - Agent Tesla Detection and Analysis](https://www.splunk.com/en_us/blog/security/inside-the-mind-of-a-rat-agent-tesla-detection-and-analysis.html)
- [Unmasking Agent Tesla: A Deep Dive into a Multi-Stage Campaign](https://www.fortinet.com/blog/threat-research/unmasking-agent-tesla-deep-dive-into-multi-stage-campaign)
- [Weaponizing Telegram Bots: How Threat Actors Exfiltrate Credentials](https://cofense.com/blog/weaponizing-telegram-bots-how-threat-actors-exfiltrate-credentials)
- [Top 10 Malware Q4 2025 (CIS MS-ISAC)](https://www.cisecurity.org/insights/blog/top-10-malware-q4-2025)
- [Agent Tesla Malware Analysis, Overview by ANY.RUN](https://any.run/malware-trends/agenttesla/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0912