| name | extracting-config-from-agent-tesla-rat |
| description | Extract embedded configuration from Agent Tesla RAT samples including SMTP/FTP/Telegram exfiltration credentials, keylogger settings, and C2 endpoints using .NET decompilation and memory analysis. |
| domain | cybersecurity |
| subdomain | malware-analysis |
| tags | ["agent-tesla","rat","config-extraction","dotnet","malware-analysis","keylogger","credential-theft"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
Extracting Config from Agent Tesla RAT
Overview
Agent Tesla is a .NET-based Remote Access Trojan (RAT) and keylogger that ranked among the top 10 malware variants in 2024, impacting 6.3% of corporate networks globally. It exfiltrates stolen credentials via SMTP email, FTP upload, Telegram bot API, or Discord webhooks. The malware configuration is embedded in the .NET assembly, typically obfuscated using string encryption, resource encryption, or custom loaders that decrypt and execute Agent Tesla in memory via .NET Reflection (fileless). Configuration extraction involves decompiling the .NET assembly with dnSpy or ILSpy, identifying the decryption routine for configuration strings, and extracting SMTP server addresses, credentials, FTP endpoints, Telegram bot tokens, and targeted applications.
Prerequisites
- dnSpy or ILSpy for .NET decompilation
- Python 3.9+ with
dnlib or pythonnet for automated extraction
- de4dot for .NET deobfuscation
- Understanding of .NET IL code and Reflection
- Sandbox for dynamic analysis (ANY.RUN, CAPE)
Practical Steps
Step 1: Deobfuscate and Extract Configuration
"""Extract Agent Tesla RAT configuration from .NET assemblies."""
import re
import sys
import json
import base64
import hashlib
from pathlib import Path
def extract_strings_from_dotnet(filepath):
"""Extract readable strings from .NET binary for config analysis."""
with open(filepath, 'rb') as f:
data = f.read()
strings = []
patterns = {
"smtp_server": re.compile(rb'smtp[\.\-][\w\.\-]+\.\w{2,}', re.I),
"email": re.compile(rb'[\w\.\-]+@[\w\.\-]+\.\w{2,}'),
"ftp_url": re.compile(rb'ftp://[\w\.\-:/]+', re.I),
"telegram_token": re.compile(rb'\d{8,10}:[A-Za-z0-9_-]{35}'),
"telegram_chat": re.compile(rb'(?:chat_id=|chatid[=:])[\-]?\d{5,15}', re.I),
"discord_webhook": re.compile(rb'https://discord\.com/api/webhooks/\d+/[\w-]+'),
"password": re.compile(rb'(?:pass(?:word)?|pwd)[=:]\s*[\w!@#$%^&*]{4,}', re.I),
"port": re.compile(rb'(?:port|smtp_port)[=:]\s*\d{2,5}', re.I),
}
results = {}
name, pattern patterns.items():
matches = pattern.findall(data)
matches:
results[name] = [m.decode(, errors=) m matches]
b64_pattern = re.()
b64_decoded = []
b64_pattern.finditer(data):
:
decoded = base64.b64decode(.group())
text = decoded.decode(, errors=)
text.isprintable() (text) > :
b64_decoded.append(text)
Exception:
b64_decoded:
results[] = b64_decoded[:]
results
():
key = .fromhex(key_hex)
decrypted_strings = []
blob_pattern = re.()
blob_pattern.finditer(data):
blob = .group()
decrypted = (b ^ key[i % (key)] i, b (blob))
:
text = decrypted.decode(, errors=)
text.isprintable() (text.strip()) > :
decrypted_strings.append(text.strip())
UnicodeDecodeError:
sha256_key = hashlib.sha256(key).digest()
decrypted_strings
():
methods = []
config.get():
methods.append({
: ,
: config[],
: config.get(, []),
})
config.get():
methods.append({
: ,
: config[],
})
config.get():
methods.append({
: ,
: config[],
: config.get(, []),
})
config.get():
methods.append({
: ,
: config[],
})
methods
__name__ == :
(sys.argv) < :
()
sys.exit()
config = extract_strings_from_dotnet(sys.argv[])
methods = analyze_exfiltration_config(config)
report = {: config, : methods}
(json.dumps(report, indent=))
Validation Criteria
- Exfiltration method identified (SMTP/FTP/Telegram/Discord)
- Server addresses and credentials extracted from config
- Targeted applications list recovered
- Keylogger and screenshot capture settings documented
- Persistence mechanism identified
- IOCs suitable for network blocking extracted
References
