S0331: Agent Tesla
Agent Tesla is a spyware Trojan written for the .NET framework that has been observed since at least 2014.[1][2][3]
Security context for executives and security teams
S0331: Agent Tesla describes [Agent Tesla](https://attack.mitre.org/software/S0331) is a spyware Trojan written for the .NET framework that has been observed since at least 2014.(Citation: Fortinet Agent Tesla April 2018)(Citation: Bitdefender Agent Tesla April 2020)(Citation: Malwarebytes Agent Tesla April 2020)
Executive priority
S0331: Agent Tesla is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S0331: Agent Tesla by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S0331: Agent Tesla appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Agent Tesla
Agent Tesla is a spyware Trojan written for the .NET framework that has been observed since at least 2014.[1][2][3]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1055 | Process Injection | Agent Tesla can inject into known, vulnerable binaries on targeted hosts.CitationSentinelLabs Agent Tesla Aug 2020 |
| Enterprise | T1497 | Virtualization/Sandbox Evasion | Agent Tesla has the ability to perform anti-sandboxing and anti-virtualization checks.[3] |
| Enterprise | T1115 | Clipboard Data | Agent Tesla can steal data from the victim’s clipboard.[4][1]CitationFortinet Agent Tesla June 2017[2] |
| Enterprise | T1566.001 | Spearphishing AttachmentSub-technique | The primary delivered mechanism for Agent Tesla is through email phishing messages.[2] |
| Enterprise | T1113 | Screen Capture | Agent Tesla can capture screenshots of the victim’s desktop.[4][5][1]CitationFortinet Agent Tesla June 2017[2] |
| Enterprise | T1087.001 | Local AccountSub-technique | Agent Tesla can collect account information from the victim’s machine.[5] |
| Enterprise | T1547.001 | Registry Run Keys / Startup FolderSub-technique | Agent Tesla can add itself to the Registry as a startup program to establish persistence.[1]CitationSentinelLabs Agent Tesla Aug 2020 |
| Enterprise | T1552.001 | Credentials In FilesSub-technique | Agent Tesla has the ability to extract credentials from configuration or support files.CitationSentinelLabs Agent Tesla Aug 2020 |
| Enterprise | T1047 | Windows Management Instrumentation | Agent Tesla has used wmi queries to gather information from the system.[2] |
| Enterprise | T1204.002 | Malicious FileSub-technique | Agent Tesla has been executed through malicious e-mail attachments [2] |
| Enterprise | T1203 | Exploitation for Client Execution | Agent Tesla has exploited Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570 for execution during delivery.CitationSentinelLabs Agent Tesla Aug 2020 |
| Enterprise | T1016 | System Network Configuration Discovery | Agent Tesla can collect the IP address of the victim machine and spawn instances of netsh.exe to enumerate wireless settings.[5]CitationSentinelLabs Agent Tesla Aug 2020 |
| Enterprise | T1218.009 | Regsvcs/RegasmSub-technique | Agent Tesla has dropped RegAsm.exe onto systems for performing malicious activity.CitationSentinelLabs Agent Tesla Aug 2020 |
| Enterprise | T1124 | System Time Discovery | Agent Tesla can collect the timestamp from the victim’s machine.[5] |
| Enterprise | T1033 | System Owner/User Discovery | Agent Tesla can collect the username from the victim’s machine.[5][1][3] |
| Enterprise | T1105 | Ingress Tool Transfer | Agent Tesla can download additional files for execution on the victim’s machine.[4][5] |
| Enterprise | T1057 | Process Discovery | Agent Tesla can list the current running processes on the system.CitationFortinet Agent Tesla June 2017 |
| Enterprise | T1555.003 | Credentials from Web BrowsersSub-technique | Agent Tesla can gather credentials from a number of browsers.[2] |
| Enterprise | T1125 | Video Capture | Agent Tesla can access the victim’s webcam and record video.[5][4] |
| Enterprise | T1027 | Obfuscated Files or Information | Agent Tesla has had its code obfuscated in an apparent attempt to make analysis difficult.[1] Agent Tesla has used the Rijndael symmetric encryption algorithm to encrypt strings.[3] |
| Enterprise | T1185 | Browser Session Hijacking | Agent Tesla has the ability to use form-grabbing to extract data from web data forms.[2] |
| Enterprise | T1071.001 | Web ProtocolsSub-technique | Agent Tesla has used HTTP for C2 communications.[5]CitationFortinet Agent Tesla June 2017 |
| Enterprise | T1048.003 | Exfiltration Over Unencrypted Non-C2 ProtocolSub-technique | Agent Tesla has routines for exfiltration over SMTP, FTP, and HTTP.[4][2]CitationSentinelLabs Agent Tesla Aug 2020 |
| Enterprise | T1564.003 | Hidden WindowSub-technique | Agent Tesla has used |
| Enterprise | T1056.001 | KeyloggingSub-technique | Agent Tesla can log keystrokes on the victim’s machine.[4][5]CitationFortinet Agent Tesla June 2017[2]CitationSentinelLabs Agent Tesla Aug 2020 |
| Enterprise | T1053.005 | Scheduled TaskSub-technique | Agent Tesla has achieved persistence via scheduled tasks.CitationSentinelLabs Agent Tesla Aug 2020 |
| Enterprise | T1564.001 | Hidden Files and DirectoriesSub-technique | Agent Tesla has created hidden folders.CitationSentinelLabs Agent Tesla Aug 2020 |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | Agent Tesla has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm.[3] |
| Enterprise | T1555 | Credentials from Password Stores | Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles.[3] |
| Enterprise | T1685 | Disable or Modify Tools | Agent Tesla has the capability to kill any running analysis processes and AV software.CitationFortinet Agent Tesla June 2017 |
| Enterprise | T1082 | System Information Discovery | Agent Tesla can collect the system's computer name and also has the capability to collect information on the processor, memory, OS, and video card from the system.[1]CitationFortinet Agent Tesla June 2017[3] |
| Enterprise | T1560 | Archive Collected Data | Agent Tesla can encrypt data with 3DES before sending it over to a C2 server.[4] |
| Enterprise | T1071.003 | Mail ProtocolsSub-technique | Agent Tesla has used SMTP for C2 communications.CitationCofense Agent TeslaCitationFortinet Agent Tesla June 2017[2] |
| Enterprise | T1112 | Modify Registry | Agent Tesla can achieve persistence by modifying Registry key entries.CitationSentinelLabs Agent Tesla Aug 2020 |
| Enterprise | T1055.012 | Process HollowingSub-technique | Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code.CitationSentinelLabs Agent Tesla Aug 2020 |
| Enterprise | T1552.002 | Credentials in RegistrySub-technique | Agent Tesla has the ability to extract credentials from the Registry.CitationSentinelLabs Agent Tesla Aug 2020 |
| Enterprise | T1016.002 | Wi-Fi DiscoverySub-technique | Agent Tesla can collect names and passwords of all Wi-Fi networks to which a device has previously connected.[3] |
Groups, software, and campaigns
G0083: SilverTerrier
SilverTerrier is a Nigerian threat group that has been seen active since 2014. SilverTerrier mainly targets organizations in high technology, higher education, and manufacturing.[1][2]
G1018: TA2541
TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.[1][2]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(3)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 20.0 | 1.3 | Current bundle | 83691898ec4c… | ||
| 19.2 | 1.3 | Older bundle | 83691898ec4c… | ||
| 19.1 | 1.3 | Older bundle | 83691898ec4c… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Fortinet Agent Tesla April 2018
Zhang, X. (2018, April 05). Analysis of New Agent Tesla Spyware Variant. Retrieved November 5, 2018.
Open source URL - [2]Bitdefender Agent Tesla April 2020
Arsene, L. (2020, April 21). Oil & Gas Spearphishing Campaigns Drop Agent Tesla Spyware in Advance of Historic OPEC+ Deal. Retrieved May 19, 2020.
Open source URL - [3]Malwarebytes Agent Tesla April 2020
Jazi, H. (2020, April 16). New AgentTesla variant steals WiFi credentials. Retrieved May 19, 2020.
Open source URL - [4]Talos Agent Tesla Oct 2018
Brumaghin, E., et al. (2018, October 15). Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox. Retrieved November 5, 2018.
Open source URL - [5]DigiTrust Agent Tesla Jan 2017
The DigiTrust Group. (2017, January 12). The Rise of Agent Tesla. Retrieved November 5, 2018.
Open source URL - [6]Agent Tesla
(Citation: Fortinet Agent Tesla April 2018)(Citation: Talos Agent Tesla Oct 2018)(Citation: DigiTrust Agent Tesla Jan 2017)
- [7]mitre-attackS0331Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.