Agent Tesla (also called NegaSteal) is a .NET keylogger and credential stealer that has been around since 2014. Its popularity comes from cheap licences and heavy packing that keeps changing.
Delivery
Mail with a macro-enabled office file is the common route (docm, xlsm, pptx and similar), though archives with an executable also circulate. The macro or a downloaded file drops the first-layer executable.
spam email
-> office document with macro
-> packer EXE (Win32 / Win64)
-> cryptor DLL (.NET)
-> loader DLL (.NET)
-> final payload EXE (VC++)
Layer by layer
- Packer. Decrypts a resource and loads the next .NET assembly directly into memory with reflection, naming the entry method explicitly. The decryption loop is rewritten for each campaign to stay below detection.
- Cryptor DLL. Looks inside the parent's resources and finds a bitmap. The next DLL is hidden in the pixel colour values, so recovering it means reversing a small image-steganography routine.
- Loader DLL. Stores an encrypted blob in the binary and applies XOR with a 16-byte key that differs per file.
- Payload. The actual stealer.
What gets stolen
System configuration, browser credentials, cookies and login data, keystrokes, screenshots and clipboard contents. It also targets FTP clients such as FileZilla, VPN clients and stored network credentials.
Everything is encrypted and sent out; in the samples I examined the exfiltration used SMTP to a mail server, with a reference to routing over Tor in other writeups.
dropped file : %APPDATA%\<random>.exe
persistence : scheduled task "Updates\<random>" created from an XML file in %TEMP%
c2 : SMTP session to a public mail provider
Why it is time-consuming
Strong obfuscators and renamed modules mean automatic de-obfuscation often fails on the latest builds, so you end up stepping through each layer in a debugger and dumping assemblies as they appear.