Skip to content

Agent Tesla

Software · ATTACK:enterprise:S0331

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0331",
  "title": "Agent Tesla",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0331",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--e7a5229f-05eb-440e-b982-9a6d2b2b87c8",
  "external_id": "S0331",
  "domain": "enterprise",
  "created": "2019-01-29T18:44:04.748Z",
  "modified": "2025-04-16T20:38:40.678Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Agent Tesla"
    },
    {
      "source_name": "Bitdefender Agent Tesla April 2020",
      "url": "https://labs.bitdefender.com/2020/04/oil-gas-spearphishing-campaigns-drop-agent-tesla-spyware-in-advance-of-historic-opec-deal/"
    },
    {
      "source_name": "Talos Agent Tesla Oct 2018",
      "url": "https://blog.talosintelligence.com/2018/10/old-dog-new-tricks-analysing-new-rtf_15.html"
    },
    {
      "source_name": "Malwarebytes Agent Tesla April 2020",
      "url": "https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/"
    },
    {
      "source_name": "DigiTrust Agent Tesla Jan 2017",
      "url": "https://www.digitrustgroup.com/agent-tesla-keylogger/"
    },
    {
      "source_name": "Fortinet Agent Tesla April 2018",
      "url": "https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html"
    }
  ]
}

Explicit source assertions (39)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0432482e-344c-4be3-9a70-5391cf41a935

SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1497

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--061f0d25-40fd-440a-b7e8-54ad0209f5f4

Malwarebytes Agent Tesla April 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06dded4b-f28c-45d3-8dc6-097a9a4a3cd6

Talos Agent Tesla Oct 2018 · Fortinet Agent Tesla April 2018 · Fortinet Agent Tesla June 2017 · Bitdefender Agent Tesla April 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06f7f9cd-4e6b-4abe-bff0-c9c0fcaf920e

Bitdefender Agent Tesla April 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08109d9e-3258-4b9b-8e1d-ea90d05c18b9

Talos Agent Tesla Oct 2018 · DigiTrust Agent Tesla Jan 2017 · Fortinet Agent Tesla April 2018 · Fortinet Agent Tesla June 2017 · Bitdefender Agent Tesla April 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d93e75b-e13d-4bd5-97d2-b4f8d05e9efd

DigiTrust Agent Tesla Jan 2017

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ecaa94b-3ad8-4de5-9cf2-81069676cfa3

Fortinet Agent Tesla April 2018 · SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19821013-5844-46b3-82e9-189b4df07b9d

SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1bce55fa-b34e-4522-9422-85bf3fdda889

Bitdefender Agent Tesla April 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1cd41777-3d65-4e39-8de7-3951d1568c16

Bitdefender Agent Tesla April 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--216e5287-2cea-4bd0-b109-24b205f848b3

SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2fc8879c-1763-4ed0-b1d8-67b4c3d49ed9

DigiTrust Agent Tesla Jan 2017 · SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1218.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30b4b9c6-1117-4242-80c4-fd7dc7016a08

SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1124

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38248217-7c11-4ae9-a13e-7296dead0df8

DigiTrust Agent Tesla Jan 2017

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e370a6e-2a3c-4e56-aa57-fecab8d09709

DigiTrust Agent Tesla Jan 2017 · Fortinet Agent Tesla April 2018 · Malwarebytes Agent Tesla April 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40ae8100-d02c-445a-acf5-8e30f04ec6c0

Talos Agent Tesla Oct 2018 · DigiTrust Agent Tesla Jan 2017

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--431012d2-0ac4-49ba-b217-c118f0c1cf03

Fortinet Agent Tesla June 2017

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47173be4-dc15-49c6-9e81-cba36c6e6c68

Bitdefender Agent Tesla April 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49efe6c7-aec6-4e54-bc7d-212816e23347

DigiTrust Agent Tesla Jan 2017 · Talos Agent Tesla Oct 2018

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d7e8d98-9894-4dfa-9013-af8d83e6faea

Fortinet Agent Tesla April 2018 · Malwarebytes Agent Tesla April 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5bbbd951-0c4a-4293-b0a8-27751b953882

Bitdefender Agent Tesla April 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e8fc958-6778-4c46-ae15-0d239309bc76

DigiTrust Agent Tesla Jan 2017 · Fortinet Agent Tesla June 2017

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60c1b489-f1fc-4568-aba0-54e932715abc

Talos Agent Tesla Oct 2018 · Bitdefender Agent Tesla April 2020 · SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1564.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75bd34c6-c8b3-4b5e-aac4-9e410515169c

Malwarebytes Agent Tesla April 2020

ATTACK:enterprise:G0083 → uses → ATTACK:enterprise:S0331

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a9b075d-4a37-4b89-8643-8b4376b79416

Unit42 SilverTerrier 2018

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--891217a4-3822-4345-b77f-448f41fd9361

Talos Agent Tesla Oct 2018 · DigiTrust Agent Tesla Jan 2017 · Fortinet Agent Tesla June 2017 · Bitdefender Agent Tesla April 2020 · SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--946eecdd-fa23-4b5d-a992-452f50e8def8

SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98132f22-5312-421a-98f4-e1741abbcd6a

SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4105315-b63d-47c9-9526-3dd388d892b4

Malwarebytes Agent Tesla April 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae151f0a-374b-47c0-a4e6-b9bdc7ee55b5

Malwarebytes Agent Tesla April 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3ac34c3-2559-4812-b143-a89805d78d49

Fortinet Agent Tesla June 2017

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b509e591-b086-4631-a9ba-5a5dc80de8d0

Fortinet Agent Tesla April 2018 · Fortinet Agent Tesla June 2017 · Malwarebytes Agent Tesla April 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c48ff628-9276-492f-a61c-73989785b292

Talos Agent Tesla Oct 2018

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c5401268-6b27-4088-9f2e-5439f68685d9

Bitdefender Agent Tesla April 2020 · Cofense Agent Tesla · Fortinet Agent Tesla June 2017

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9cd513e-c863-4695-a6e0-b2e4e79c24e8

SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ddee8f55-feed-4474-b996-b80bbe5209a4

SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1552.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2ac3f65-68d3-45d2-8aab-b2bd57036fa8

SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:S0331

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2c596fa-0f20-4435-9ace-798954f5be85

Proofpoint TA2541 February 2022

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1016.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd348c91-a296-4bd0-b31c-894141a2827c

Malwarebytes Agent Tesla April 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.