Agent Tesla: Forensic Reverse-Engineering & Architectural Dossier

Compiled as an intermediate language (CIL/MSIL) PE32 executable targeting .NET Framework v2.0 through v4.6. Binary sections consist of standard MSIL metadata headers (.text, .rsrc, .reloc), lacking native x86 machine opcodes prior to JIT compilation. Common crypter overlays include PureCrypter, CypherIT (AutoIt wrapper), and custom XOR/AES stagers that store the payload inside embedded resource blobs or bitmap pixel data (steganography). The runtime resolves external dependencies dynamically via System.Reflection.Assembly.Load, evading disk-based static file signatures.

The builder utility is developed in WinForms (.NET GUI) and provides operator configuration for delivery conduits: SMTP Server (Host, Port, SSL toggle, Username, Password, Target Recipient), FTP (Host, User, Pass, Port, Subfolder), Telegram Bot (API Token, Target Chat ID), and Discord Webhook URL. It exposes toggles for local surveillance modules: Keylogger (Interval minutes), Screenshot Capturer (JPEG quality 50-100%, interval), Clipboard Logger, Webcam Grabber, and Target Application Checklists. Configuration variables are compiled directly into the binary either as a .NET resource named 'Properties.Settings' or initialized within the static constructor (.cctor) of an obfuscated class via multi-stage Base64 decoding and single-byte or multi-byte XOR masking.

struct Agent_Tesla_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

Execution relies on Process Hollowing (RunPE). The unpacked stub creates a suspended legitimate Windows process (e.g., RegSvcs.exe, RegAsm.exe, vbc.exe, cvtres.exe, or MSBuild.exe) using CreateProcessW(CREATE_SUSPENDED = 0x00000004). It queries the suspended thread context via GetThreadContext, carves the original executable memory via NtUnmapViewOfSection / ZwUnmapViewOfSection, allocates replacement virtual memory with VirtualAllocEx(PAGE_EXECUTE_READWRITE = 0x40), and writes the decompressed Agent Tesla PE headers and sections using WriteProcessMemory. The entry point register (EAX on x86, RCX on x64) or PEB base (EBX+8 / RDX+0x10) is rewritten, followed by SetThreadContext and ResumeThread. Memory evasion features include AMSI patching by writing a ret instruction (0xC3) to amsi.dll!AmsiScanBuffer and ETW suppression via EtwEventWrite nop-sledging.

Concrete technical breakdown of functional modules implemented in the Agent Tesla binary:

Exfiltration channels operate over one of four selectable transports: 1) SMTP: Connects via System.Net.Mail.SmtpClient using STARTTLS (TCP 587) or SMTPS (TCP 465). Generates an email with subject line '<ComputerName>/<UserName> Agent Tesla Keylogger - <Timestamp>'. The message body contains HTML-formatted keylog text and attached ZIP/TXT archives of recovered credentials. 2) FTP: Uploads log files named 'log.html' and 'passwords.txt' using FtpWebRequest in passive mode. 3) Telegram: Posts JSON multipart/form-data to 'https://api.telegram.org/bot<TOKEN>/sendDocument' with the 'chat_id' parameter and file attachment. 4) HTTP POST: Issues HTTP/1.1 POST requests to an operator panel URL containing Base64-encoded, DES/AES-encrypted POST parameters.

Indicators of compromise and forensic patterns recorded across laboratory triage: