Agent Tesla

MITRE ATT&CK: S0331 View on attack.mitre.org

Aliases: AgenTesla, AgentTesla, Negasteal, Agent Tesla

First seen
2014-01-01 00:00:00
Malware type
spyware, trojan, credential-stealer, keylogger, screen-capture
Family
Malware family
Operating systems
windows
Related IoCs
24447 (23752 malicious)
Last IoC activity
2026-09-02 03:45:05
Profile updated
2026-07-07 12:37:53

Targeted industries: healthcare-and-pharmaceutical financial-services government-and-public-sector retail-and-hospitality transportation-and-logistics

Context

Agent Tesla is a spyware Trojan written for the .NET framework that has been observed since at least 2014.

Recent IoC activity

23,764 malicious indicators in Maltiverse are attributed to Agent Tesla (S0331). The 20 most recently updated:

TypeIndicatorUpdatedSources
file sample 86f7459bb61b6eaf595824dc945f72659d557a8bdda517153053e734d80d7799 2026-09-03 2
file sample 8722d9be017fd945c9ace288f405051fd8ced8c141cadf680448d4e6cd5bf8ac 2026-09-03 3
file sample 872f1970c19bbf2031fe43f9ed034f1edd2763e6ecda2de368336da3312d8463 2026-09-03 2
file sample 8747e56c9e9e2503dc7664fde2a9be12186fc7696ab06a4e86c932f65f4f2a1d 2026-09-03 3
file sample 87600ddc2aad3a016b4594fb63f7e9179f85aa07e8dd318438485afb4976cb85 2026-09-03 2
file sample 8797ef6cb2e95b65334b38d11068783acad3aa173ede96e152ad66beb40deee3 2026-09-03 2
URL https://www.mediafire.com/file/6urm5ylq31a3s24/Odeme_makbuzu.7z/file 2026-09-03 1
file sample nsc.hta 2026-09-03 2
file sample 8647436d5b5e93de1fbaf9571e584ceaee4a620cd39b60472da87e694239c317 2026-09-03 3
file sample 8632a6cdacd3c2ca44c427d1ef6bea4a9c16a7089a31f12fe79ba6e108860902 2026-09-03 3
file sample 864fd318ac33d9788aaaa7ec0414ace672ca381ef2f7d4d878e3e4789c9b8976 2026-09-03 2
file sample 86ac1f32be9c3eac5a0ae2b75fb7d4abd9cb153cebebdb56e8859b7f1d1858ee 2026-09-03 2
file sample 86c0e8c71fe53ff1ee1ac2a494c208392b9f4128f85552e69105e8fa19724f63 2026-09-03 3
hostname theremedycenter.com 2026-09-03 4
hostname ftp.dklak.cam 2026-09-03 1
hostname ekonomski.ba 2026-09-03 2
hostname libazo.com 2026-09-03 1
hostname swissprint-online.ch 2026-09-03 1
hostname taxmogalupupitpamobitola.blogspot.com 2026-09-03 1
hostname cawp1.blogspot.com 2026-09-03 1

Detection coverage

  • 6 YARA rules
  • 818 Sigma rules

Malware & tools used

  • Process Injection (attack-pattern)
  • Virtualization/Sandbox Evasion (attack-pattern)
  • Clipboard Data (attack-pattern)
  • Spearphishing Attachment (attack-pattern)
  • Screen Capture (attack-pattern)
  • Local Account (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)
  • Credentials In Files (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • Malicious File (attack-pattern)
  • Exploitation for Client Execution (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Regsvcs/Regasm (attack-pattern)
  • System Time Discovery (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Process Discovery (attack-pattern)
  • Credentials from Web Browsers (attack-pattern)
  • Video Capture (attack-pattern)
  • Obfuscated Files or Information (attack-pattern)
  • Browser Session Hijacking (attack-pattern)
  • Web Protocols (attack-pattern)
  • Exfiltration Over Unencrypted Non-C2 Protocol (attack-pattern)
  • Hidden Window (attack-pattern)
  • Keylogging (attack-pattern)

Used by threat actors

Exploited vulnerabilities

  • CVE-2023-38831 (vulnerability)

Detection rules

  • COD3NYM_SUSP_OBF_NET_Reactor_Native_Stub_Jan24 (yara-rule)
  • CAPE_Agentteslav4Jit (yara-rule)
  • CAPE_Agentteslav3Jit (yara-rule)
  • CAPE_Agent_Tesla (yara-rule)
  • CAPE_Agenttesla (yara-rule)
  • CAPE_Agentteslav4 (yara-rule)

Reports & references

  • pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)
  • Cisco Talos — Sweed Agent Tesla (report)
  • secureworks.com — Gold Galleon How A Nigerian Cyber Crew Plunders The Shipping Industry (report)
  • secureworks.com — Gold Galleon (report)
  • proofpoint.com — Dtpacker Net Packer Curious Password 1 (report)
  • team-cymru.com — An Analysis Of Infrastructure Linked To The Hagga Threat Actor (report)
  • research.checkpoint.com — Agent Tesla Targeting United States And Australia (report)
  • CISA — Aa20 345A (report)
  • blogs.blackberry.com — Dot Net Stubs Sowing The Seeds Of Discord (report)
  • checkpoint.com — March 2022S Most Wanted Malware Easter Phishing Scams Help Emotet Assert Its Dominance (report)
  • ptsecurity.com — Steganoamor Campaign Ta558 Mass Attacking Companies And Public Institutions All Around The World (report)
  • research.checkpoint.com — Foxit Pdf Flawed Design Exploitation (report)
  • Cisco Talos — 2020 Year In Malware (report)
  • cisecurity.org — Top 10 Malware March 2022 (report)
  • spamhaus.org — 2020 Q2 Spamhaus Botnet Threat Report (report)
  • marcoramilli.com — C2 Traffic Patterns Personal Notes (report)
  • lac.co.jp — 20220307 002893 (report)
  • cip.gov.ua — Khto Stoyit Za Kiberatakami Na Ukrayinsku Kritichnu Informaciinu Infrastrukturu Statistika 15 22 Bereznya (report)
  • proofpoint.com — New Whiteshadow Downloader Uses Microsoft Sql Retrieve Malware (report)
  • bitsight.com — Exfiltration Over Telegram Bots Skidding Infostealer Logs (report)
  • ciphertechsolutions.com — Roboski Global Recovery Automation (report)
  • malwarebytes.com — 20221121 Threat Intel Report Final (report)
  • securityintelligence.com — Roboski Global Recovery Automation (report)
  • blog.netlab.360.com — Purecrypter (report)
  • securityintelligence.com — Spam Trends Campaigns Senior Superlatives 2023 (report)

External references