MALWARE FAMILY

Agent Tesla

Internal ID: win.agent_tesla

aliases

Last seen:Mar 17, 2026

Intelligence Profile

A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.

Threat Analysis

Agent Tesla is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://blog.nsfocus.net/sweed-611/

→http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/

→http://ropgadget.com/posts/originlogger.html

→http://www.secureworks.com/research/threat-profiles/gold-galleon

→https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/

→https://asec.ahnlab.com/ko/29133/

→https://blog.apnic.net/2022/03/31/how-to-detect-and-prevent-common-data-exfiltration-attacks/

→https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/

→https://blog.cluster25.duskrise.com/2023/10/12/cve-2023-38831-russian-attack

→https://blog.fortinet.com/2017/06/28/in-depth-analysis-of-net-malware-javaupdtr

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.agent_tesla

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Agent Tesla