# Agent Tesla RAT: credential, keystroke and clipboard theft with Telegram exfiltration

> Agent Tesla is a .NET spyware/RAT sold as malware-as-a-service since at least 2014 that steals keystrokes, clipboard content, screenshots, browser credentials and email passwords. It is delivered mainly by phishing, often through multi-stage loaders, and exfiltrates over SMTP, FTP, HTTP or Telegram.

- **Published:** 2026-10-17T01:17:42Z
- **Last reviewed:** 2026-10-17T01:17:42Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3793
- **ID:** TL-2026-3793
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Agent Tesla (MITRE ATT&CK S0331) is a .NET-based spyware Trojan and remote access tool that has been sold as a commodity malware-as-a-service product since at least 2014. MITRE links its use to the SilverTerrier business-email-compromise cluster (G0083) and the phishing group TA2541 (G1018). Deep Instinct's DIANNA analysis (July 2025) describes a variant that records keystrokes, clipboard contents, browser credentials and email passwords, performs file operations and exfiltration, interacts with the Windows registry, creates temporary files, launches programs and modifies ACLs. It uses Telegram as its data-exfiltration channel. The variant shows anti-analysis behavior: execution-timing checks, identification of security tools, packed or encoded code with abnormal text-section entropy, and mimicry of legitimate activity during reconnaissance. Its strings suggest fake dialogs and prompts for social engineering. Deep Instinct reports its DSX Brain detected the sample one day before VirusTotal submission, while most vendors did not flag it until 2-3 days after upload.

Delivery is typically phishing. A March 2024 Trustwave SpiderLabs campaign used a Polish bank-payment lure with a .tar.gz archive attachment and a .NET loader that patches AmsiScanBuffer before decoding an XOR-encoded Agent Tesla payload in memory; it exfiltrated by SMTP through a compromised Turkish company mailbox. In September 2023 Fortinet documented a Word-document campaign that delivered Agent Tesla (SMTP C2) alongside OriginBotnet and RedLine Clipper through a .NET loader padded to about 400 MB to evade scanning. Since November 2024 IBM X-Force has observed the QuirkyLoader loader delivering Agent Tesla and other families: an archive holding a legitimate executable, an encrypted payload and a malicious DLL is side-loaded, and the payload is injected by process hollowing into AddInProcess32.exe, InstallUtil.exe or aspnet_wp.exe.

An ANY.RUN sandbox run (10 May 2025) of a Telegram-exfiltrating sample shows the typical host footprint: execution from %TEMP%, a copy dropped under %APPDATA%\Roaming, persistence through a scheduled task created from an XML temp file, an external-IP lookup via api.ipify.org, credential theft from browsers, keylogging and screenshots, and exfiltration to api.telegram.org via a bot. MITRE additionally documents process hollowing, Regsvcs/Regasm proxy execution, registry Run keys, credential theft from files and the registry, Wi-Fi profile discovery and webcam capture. Note: the DIANNA article itself provides no IOCs, versions, attribution or ATT&CK mapping; IOCs here come from the cited third-party sandbox and vendor reporting.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1055.012 Process Hollowing
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1685 Disable or Modify Tools
- T1574.001 DLL
- T1555.003 Credentials from Web Browsers
- T1056.001 Keylogging
- T1113 Screen Capture
- T1082 System Information Discovery
- T1071.001 Web Protocols
- T1567 Exfiltration Over Web Service
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

## Sources

- [DIANNA Explains 2: Agent Tesla - A Better RAT](https://www.deepinstinct.com/blog/dianna-explains-2-agent-tesla-a-better-rat)
- [MITRE ATT&CK: Agent Tesla (S0331)](https://attack.mitre.org/software/S0331/)
- [ANY.RUN sandbox report: Agent Tesla with Telegram C2](https://any.run/report/2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb/3841d596-ccca-45a9-8c62-a45522c933fa)
- [The Hacker News: New Phishing Attack Delivers Agent Tesla via Fresh Loader (Trustwave SpiderLabs)](https://thehackernews.com/2024/03/alert-new-phishing-attack-delivers.html)
- [The Hacker News: Sophisticated Phishing Campaign Delivers Agent Tesla, OriginBotnet and RedLine Clipper (Fortinet)](https://thehackernews.com/2023/09/sophisticated-phishing-campaign.html)
- [IBM X-Force Threat Analysis: QuirkyLoader - A new malware loader delivering infostealers and RATs](https://www.ibm.com/think/x-force/ibm-x-force-threat-analysis-quirkyloader)
- [The Hacker News: Hackers Using New QuirkyLoader Malware](https://thehackernews.com/2025/08/hackers-using-new-quirkyloader-malware.html)
- [WeLiveSecurity: Agent Tesla - principales caracteristicas de este malware](https://www.welivesecurity.com/la-es/2021/04/28/agent-tesla-principales-caracteristicas-este-malware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3793