What problem does it solve?
Agent Tesla hides its configuration behind string encryption, resource obfuscation, and in-memory loaders, so simple string searches on the binary return nothing useful. This Skill guides analysts through deobfuscating the .NET assembly, replaying the embedded decryption routine, and recovering SMTP, FTP, Telegram, and Discord exfiltration settings.
Core Features & Use Cases
- Automated Config Extraction: A Python script scans the binary for SMTP servers, email addresses, FTP URLs, Telegram bot tokens, Discord webhooks, and Base64-encoded strings.
- Deobfuscation Workflow: Covers de4dot cleanup, dnSpy/ILSpy decompilation, and memory dumping of fileless second-stage payloads with MegaDumper or pe-sieve.
- Validation Guidance: Explains how to confirm extracted artifacts (Telegram token format checks, sandbox corroboration via ANY.RUN or CAPE) and avoid false positives from benign .NET apps.
- Use Case: During incident response, an analyst receives a phishing attachment identified as Agent Tesla and uses this workflow to extract the attacker's SMTP credentials and Telegram bot token, producing IOCs for network blocking.
Quick Start
Analyze the attached Agent Tesla sample and extract its exfiltration configuration including SMTP, FTP, Telegram, and Discord endpoints.
