What it does. Extracts embedded configuration from Agent Tesla RAT samples, including Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill extracting-config-from-agent-tesla-rat, or copy the skill folder into ~/.claude/skills/extracting-config-from-agent-tesla-rat/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/extracting-config-from-agent-tesla-rat/SKILL.md

SKILL.md (verbatim)

name: extracting-config-from-agent-tesla-rat
description: Extracts embedded configuration from Agent Tesla RAT samples, including
  SMTP/FTP/Telegram exfiltration credentials, keylogger settings, and C2 endpoints,
  via .NET decompilation and memory analysis. Use when analyzing a suspected or
  confirmed Agent Tesla sample and you need to recover its exfiltration channel
  and C2 configuration for threat intelligence or incident response.
domain: cybersecurity
subdomain: malware-analysis
tags:
- agent-tesla
- rat
- config-extraction
- dotnet
- malware-analysis
- keylogger
- credential-theft
version: '1.0'
author: mahipal
license: Apache-2.0
atlas_techniques:
- AML.T0024
- AML.T0056
- AML.T0086
nist_ai_rmf:
- GOVERN-1.1
- MEASURE-2.7
- MANAGE-3.1
nist_csf:
- DE.AE-02
- RS.AN-03
- ID.RA-01
- DE.CM-01
mitre_attack:
- T1027
- T1055
- T1140
- T1497
- T1003

Extracting Config from Agent Tesla RAT

Overview

Agent Tesla is a .NET-based Remote Access Trojan (RAT) and keylogger that ranked among the top 10 malware variants in 2024, impacting 6.3% of corporate networks globally. It exfiltrates stolen credentials via SMTP email, FTP upload, Telegram bot API, or Discord webhooks. The malware configuration is embedded in the .NET assembly, typically obfuscated using string encryption, resource encryption, or custom loaders that decrypt and execute Agent Tesla in memory via .NET Reflection (fileless). Configuration extraction involves decompiling the .NET assembly with dnSpy or ILSpy, identifying the decryption routine for configuration strings, and extracting SMTP server addresses, credentials, FTP endpoints, Telegram bot tokens, and targeted applications.

When to Use

• When performing authorized security testing that involves extracting config from agent tesla rat
• When analyzing malware samples or attack artifacts in a controlled environment
• When conducting red team exercises or penetration testing engagements
• When building detection capabilities based on offensive technique understanding

Prerequisites

• dnSpy or ILSpy for .NET decompilation
• Python 3.9+ with dnlib or pythonnet for automated extraction
• de4dot for .NET deobfuscation
• Understanding of .NET IL code and Reflection
• Sandbox for dynamic analysis (ANY.RUN, CAPE)

Workflow

Step 1: Deobfuscate and Extract Configuration

#!/usr/bin/env python3
"""Extract Agent Tesla RAT configuration from .NET assemblies."""
import re
import sys
import json
import base64
import hashlib
from pathlib import Path


def extract_strings_from_dotnet(filepath):
    """Extract readable strings from .NET binary for config analysis."""
    with open(filepath, 'rb') as f:
        data = f.read()

    # Extract US (User Strings) heap from .NET metadata
    strings = []

    # Look for common Agent Tesla config patterns
    patterns = {
        "smtp_server": re.compile(rb'smtp[\.\-][\w\.\-]+\.\w{2,}', re.I),
        "email": re.compile(rb'[\w\.\-]+@[\w\.\-]+\.\w{2,}'),
        "ftp_url": re.compile(rb'ftp://[\w\.\-:/]+', re.I),
        "telegram_token": re.compile(rb'\d{8,10}:[A-Za-z0-9_-]{35}'),
        "telegram_chat": re.compile(rb'(?:chat_id=|chatid[=:])[\-]?\d{5,15}', re.I),
        "discord_webhook": re.compile(rb'https://discord\.com/api/webhooks/\d+/[\w-]+'),
        "password": re.compile(rb'(?:pass(?:word)?|pwd)[=:]\s*[\w!@#$%^&*]{4,}', re.I),
        "port": re.compile(rb'(?:port|smtp_port)[=:]\s*\d{2,5}', re.I),
    }

    results = {}
    for name, pattern in patterns.items():
        matches = pattern.findall(data)
        if matches:
            results[name] = [m.decode('utf-8', errors='replace') for m in matches]

    # Extract Base64-encoded strings (common obfuscation)
    b64_pattern = re.compile(rb'[A-Za-z0-9+/]{20,}={0,2}')
    b64_decoded = []
    for match in b64_pattern.finditer(data):
        try:
            decoded = base64.b64decode(match.group())
            text = decoded.decode('utf-8', errors='strict')
            if text.isprintable() and len(text) > 5:
                b64_decoded.append(text)
        except Exception:
            pass

    if b64_decoded:
        results["base64_decoded_strings"] = b64_decoded[:30]

    return results


def decrypt_agenttesla_strings(data, key_hex):
    """Decrypt Agent Tesla encrypted configuration strings."""
    key = bytes.fromhex(key_hex)
    # Agent Tesla V1: Simple XOR with key
    decrypted_strings = []

    # Find encrypted blobs (high-entropy byte sequences)
    blob_pattern = re.compile(rb'[\x80-\xff]{16,256}')
    for match in blob_pattern.finditer(data):
        blob = match.group()
        # Try XOR decryption
        decrypted = bytes(b ^ key[i % len(key)] for i, b in enumerate(blob))
        try:
            text = decrypted.decode('utf-8', errors='strict')
            if text.isprintable() and len(text.strip()) > 3:
                decrypted_strings.append(text.strip())
        except UnicodeDecodeError:
            pass

    # V2: SHA256-based key derivation then AES
    sha256_key = hashlib.sha256(key).digest()

    return decrypted_strings


def analyze_exfiltration_config(config):
    """Analyze extracted configuration for exfiltration methods."""
    methods = []

    if config.get("smtp_server"):
        methods.append({
            "type": "SMTP",
            "servers": config["smtp_server"],
            "emails": config.get("email", []),
        })

    if config.get("ftp_url"):
        methods.append({
            "type": "FTP",
            "urls": config["ftp_url"],
        })

    if config.get("telegram_token"):
        methods.append({
            "type": "Telegram",
            "tokens": config["telegram_token"],
            "chat_ids": config.get("telegram_chat", []),
        })

    if config.get("discord_webhook"):
        methods.append({
            "type": "Discord",
            "webhooks": config["discord_webhook"],
        })

    return methods


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <agent_tesla_sample>")
        sys.exit(1)

    config = extract_strings_from_dotnet(sys.argv[1])
    methods = analyze_exfiltration_config(config)

    report = {"raw_config": config, "exfiltration_methods": methods}
    print(json.dumps(report, indent=2))

Validation Criteria

• Exfiltration method identified (SMTP/FTP/Telegram/Discord)
• Server addresses and credentials extracted from config
• Targeted applications list recovered
• Keylogger and screenshot capture settings documented
• Persistence mechanism identified
• IOCs suitable for network blocking extracted

References

• Splunk - Agent Tesla Detection and Analysis
• Qualys - Catching the RAT Agent Tesla
• ANY.RUN Agent Tesla Analysis
• Trustwave - Agent Tesla Novel Loader
• Malpedia - Agent Tesla

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py

assets/template.md (verbatim)

Analysis Report Template - extracting-config-from-agent-tesla-rat

Sample Information

Findings

IOCs Extracted

Recommendations

references/api-reference.md (verbatim)

API Reference: Agent Tesla RAT Configuration Extraction

Agent Tesla Overview

• Type: .NET RAT / Information Stealer
• Exfiltration: SMTP, FTP, Telegram, HTTP POST
• Capabilities: Keylogging, clipboard, screenshots, credential theft

String Extraction

Python Regex for ASCII Strings

re.finditer(rb'[\x20-\x7e]{6,}', binary_data)

Wide Strings (UTF-16LE)

re.finditer(rb'(?:[\x20-\x7e]\x00){6,}', binary_data)

Configuration Indicators

SMTP Exfiltration

FTP Exfiltration

Telegram Bot

.NET Decompilation

dnSpy

# Open sample in dnSpy
# Navigate to namespace: AgentTesla / WebMonitor / etc.
# Look for hardcoded credentials in static fields

ILSpy / dotPeek

Alternative .NET decompilers for config extraction.

YARA Rule

rule AgentTesla {
    meta:
        description = "Agent Tesla keylogger/RAT"
    strings:
        $smtp = "SmtpPort" ascii wide
        $hook = "KeyboardHook" ascii wide
        $clip = "GetClipboardData" ascii wide
        $ns1 = "AgentTesla" ascii
        $ns2 = "WebMonitor" ascii
    condition:
        uint16(0) == 0x5A4D and 3 of them
}

File Hashing

Python hashlib

import hashlib
sha256 = hashlib.sha256(open(path, 'rb').read()).hexdigest()

VirusTotal API — Sample Lookup

GET https://www.virustotal.com/api/v3/files/{sha256}
x-apikey: {API_KEY}

Response Fields

Sandbox Analysis

• ANY.RUN: Interactive analysis
• Hybrid Analysis: Automated report
• Joe Sandbox: Deep behavioral analysis

references/standards.md (verbatim)

Standards Reference - extracting-config-from-agent-tesla-rat

Applicable Standards

• MITRE ATT&CK Framework
• NIST SP 800-83 Guide to Malware Incident Prevention
• NIST SP 800-86 Guide to Integrating Forensic Techniques

Related MITRE ATT&CK Techniques

See SKILL.md for specific technique mappings.

references/workflows.md (verbatim)

Analysis Workflows - extracting-config-from-agent-tesla-rat

Primary Workflow

[Sample Collection] --> [Static Analysis] --> [Dynamic Analysis] --> [IOC Extraction]
                                                                          |
                                                                          v
                                                                 [Report Generation]

See SKILL.md for detailed step-by-step procedures.

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.