Agent Tesla

MITRE ATT&CK: S0331 View on attack.mitre.org

Aliases: AgenTesla, AgentTesla, Negasteal, Agent Tesla

First seen
2014-01-01 00:00:00
Malware type
spyware, trojan, credential-stealer, keylogger, screen-capture
Family
Malware family
Operating systems
windows
Related IoCs
26799 (26005 malicious)
Last IoC activity
2026-10-18 04:24:14
Profile updated
2026-07-07 12:37:53

Targeted industries: healthcare-and-pharmaceutical financial-services government-and-public-sector retail-and-hospitality transportation-and-logistics

Context

Agent Tesla is a spyware Trojan written for the .NET framework that has been observed since at least 2014.

Recent IoC activity

26,005 malicious indicators in Maltiverse are attributed to Agent Tesla (S0331). The 20 most recently updated:

TypeIndicatorUpdatedSources
file sample rSolicita____odePropostas_pdf.exe 2026-10-18 3
hostname titupatiyannala-myrynaal.blogspot.com 2026-10-18 1
hostname spencerstuartllc.top 2026-10-18 3
hostname ftp.gantelopex.com 2026-10-18 1
file sample 1726170427668618960c4000908de2329a5fa514b5577035513c21b3b8b4277dc07f93cdfa797... 2026-10-18 3
hostname skysky.duckdns.org 2026-10-18 3
hostname futuresbuilder.net 2026-10-18 2
hostname hotelbackuppowaug.blogspot.com 2026-10-18 1
hostname samhwansleel.com 2026-10-18 1
hostname ftp.melrz.com 2026-10-18 1
hostname strongodss.ddns.net 2026-10-18 3
hostname kdaoskdokaodkwldld.blogspot.com 2026-10-18 1
hostname pushkin231.mooo.com 2026-10-18 1
hostname tr1.hostgator.com.tr 2026-10-18 1
hostname resutanur.blogspot.com 2026-10-18 2
hostname idropbux.blogspot.com 2026-10-18 2
hostname libazo.com 2026-10-18 1
hostname thankforeverythingeheheh.blogspot.com 2026-10-18 1
hostname tehnomag.rs 2026-10-18 1
hostname machearkalonikahdi.blogspot.com 2026-10-18 1

Detection coverage

  • 6 YARA rules
  • 818 Sigma rules

Malware & tools used

  • Process Injection (attack-pattern)
  • Virtualization/Sandbox Evasion (attack-pattern)
  • Clipboard Data (attack-pattern)
  • Spearphishing Attachment (attack-pattern)
  • Screen Capture (attack-pattern)
  • Local Account (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)
  • Credentials In Files (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • Malicious File (attack-pattern)
  • Exploitation for Client Execution (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Regsvcs/Regasm (attack-pattern)
  • System Time Discovery (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Process Discovery (attack-pattern)
  • Credentials from Web Browsers (attack-pattern)
  • Video Capture (attack-pattern)
  • Obfuscated Files or Information (attack-pattern)
  • Browser Session Hijacking (attack-pattern)
  • Web Protocols (attack-pattern)
  • Exfiltration Over Unencrypted Non-C2 Protocol (attack-pattern)
  • Hidden Window (attack-pattern)
  • Keylogging (attack-pattern)

Used by threat actors

Exploited vulnerabilities

  • CVE-2023-38831 (vulnerability)

Detection rules

  • CAPE_Agent_Tesla (yara-rule)
  • CAPE_Agenttesla (yara-rule)
  • CAPE_Agentteslav4 (yara-rule)
  • CAPE_Agentteslav4Jit (yara-rule)
  • CAPE_Agentteslav3Jit (yara-rule)
  • COD3NYM_SUSP_OBF_NET_Reactor_Native_Stub_Jan24 (yara-rule)

Reports & references

  • proofpoint.com — Dtpacker Net Packer Curious Password 1 (report)
  • team-cymru.com — An Analysis Of Infrastructure Linked To The Hagga Threat Actor (report)
  • blogs.blackberry.com — Dot Net Stubs Sowing The Seeds Of Discord (report)
  • checkpoint.com — March 2022S Most Wanted Malware Easter Phishing Scams Help Emotet Assert Its Dominance (report)
  • spamhaus.org — 2020 Q2 Spamhaus Botnet Threat Report (report)
  • marcoramilli.com — C2 Traffic Patterns Personal Notes (report)
  • lac.co.jp — 20220307 002893 (report)
  • cip.gov.ua — Khto Stoyit Za Kiberatakami Na Ukrayinsku Kritichnu Informaciinu Infrastrukturu Statistika 15 22 Bereznya (report)
  • proofpoint.com — New Whiteshadow Downloader Uses Microsoft Sql Retrieve Malware (report)
  • bitsight.com — Exfiltration Over Telegram Bots Skidding Infostealer Logs (report)
  • ciphertechsolutions.com — Roboski Global Recovery Automation (report)
  • malwarebytes.com — 20221121 Threat Intel Report Final (report)
  • securityintelligence.com — Roboski Global Recovery Automation (report)
  • pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)
  • secureworks.com — Gold Galleon How A Nigerian Cyber Crew Plunders The Shipping Industry (report)
  • secureworks.com — Gold Galleon (report)
  • Cisco Talos — Sweed Agent Tesla (report)
  • research.checkpoint.com — Agent Tesla Targeting United States And Australia (report)
  • CISA — Aa20 345A (report)
  • cisecurity.org — Top 10 Malware March 2022 (report)
  • research.checkpoint.com — Foxit Pdf Flawed Design Exploitation (report)
  • ptsecurity.com — Steganoamor Campaign Ta558 Mass Attacking Companies And Public Institutions All Around The World (report)
  • Cisco Talos — 2020 Year In Malware (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Agent Tesla (report)
  • denexus.io — Threat Actor Targeting Gas Oil Supply Chains Public (report)

External references