extracting-config-from-agent-tesla-rat

name	extracting-config-from-agent-tesla-rat
description	Extract embedded configuration from Agent Tesla RAT samples including SMTP/FTP/Telegram exfiltration credentials, keylogger settings, and C2 endpoints using .NET decompilation and memory analysis. Use when working with extracting config from agent tesla rat.
domain	cybersecurity
subdomain	malware-analysis
tags	["agent-tesla","rat","config-extraction","dotnet","malware-analysis","keylogger","credential-theft"]
version	1.0
author	oyi77
license	Apache-2.0
atlas_techniques	["AML.T0024","AML.T0056","AML.T0086"]
nist_ai_rmf	["GOVERN-1.1","MEASURE-2.7","MANAGE-3.1"]
nist_csf	["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"]

Extracting Config from Agent Tesla RAT

Overview

Agent Tesla is a .NET-based Remote Access Trojan (RAT) and keylogger that ranked among the top 10 malware variants in 2024, impacting 6.3% of corporate networks globally. It exfiltrates stolen credentials via SMTP email, FTP upload, Telegram bot API, or Discord webhooks. The malware configuration is embedded in the .NET assembly, typically obfuscated using string encryption, resource encryption, or custom loaders that decrypt and execute Agent Tesla in memory via .NET Reflection (fileless). Configuration extraction involves decompiling the .NET assembly with dnSpy or ILSpy, identifying the decryption routine for configuration strings, and extracting SMTP server addresses, credentials, FTP endpoints, Telegram bot tokens, and targeted applications.

When to Use

Trigger phrases:

• "extracting config from agent tesla rat"

• "Extract embedded configuration from Agent Tesla RAT samples including SMTP/FTP/T"

• When performing authorized security testing that involves extracting config from agent tesla rat

• When analyzing malware samples or attack artifacts in a controlled environment

• When conducting red team exercises or penetration testing engagements

• When building detection capabilities based on offensive technique understanding

Prerequisites

• dnSpy or ILSpy for .NET decompilation
• Python 3.9+ with dnlib or pythonnet for automated extraction
• de4dot for .NET deobfuscation
• Understanding of .NET IL code and Reflection
• Sandbox for dynamic analysis (ANY.RUN, CAPE)

Workflow

1. Scope the task — define objectives, boundaries, and success criteria
2. Gather information — collect all necessary data and context before proceeding
3. Execute the core workflow — follow the domain-specific steps methodically
4. Validate results — verify outputs against expected outcomes or baselines
5. Document findings — record results, anomalies, and recommendations

Step 1: Deobfuscate and Extract Configuration

#!/usr/bin/env python3
"""Extract Agent Tesla RAT configuration from .NET assemblies."""
import re
import sys
 json
 base64
 hashlib
 pathlib  Path


 ():
    
     (filepath, )  f:
        data = f.read()

    
    strings = []

    
    patterns = {
        : re.(, re.I),
        : re.(),
        : re.(, re.I),
        : re.(),
        : re.(, re.I),
        : re.(),
        : re.(, re.I),
        : re.(, re.I),
    }

    results = {}
     name, pattern  patterns.items():
        matches = pattern.findall(data)
         matches:
            results[name] = [m.decode(, errors=)  m  matches]

    
    b64_pattern = re.()
    b64_decoded = []
       b64_pattern.finditer(data):
        :
            decoded = base64.b64decode(.group())
            text = decoded.decode(, errors=)
             text.isprintable()  (text) > :
                b64_decoded.append(text)
         Exception:
            

     b64_decoded:
        results[] = b64_decoded[:]

     results


 ():
    
    key = .fromhex(key_hex)
    
    decrypted_strings = []

    
    blob_pattern = re.()
       blob_pattern.finditer(data):
        blob = .group()
        
        decrypted = (b ^ key[i % (key)]  i, b  (blob))
        :
            text = decrypted.decode(, errors=)
             text.isprintable()  (text.strip()) > :
                decrypted_strings.append(text.strip())
         UnicodeDecodeError:
            

    
    sha256_key = hashlib.sha256(key).digest()

     decrypted_strings


 ():
    
    methods = []

     config.get():
        methods.append({
            : ,
            : config[],
            : config.get(, []),
        })

     config.get():
        methods.append({
            : ,
            : config[],
        })

     config.get():
        methods.append({
            : ,
            : config[],
            : config.get(, []),
        })

     config.get():
        methods.append({
            : ,
            : config[],
        })

     methods


 __name__ == :
     (sys.argv) < :
        ()
        sys.exit()

    config = extract_strings_from_dotnet(sys.argv[])
    methods = analyze_exfiltration_config(config)

    report = {: config, : methods}
    (json.dumps(report, indent=))