Can this skill decrypt obfuscated malware strings?

Yes, it includes logic for identifying high-entropy blobs and applying XOR or SHA256-based AES decryption common in Agent Tesla variants.

Is this skill safe to use on my primary machine?

Malware analysis should always be conducted in an isolated sandbox or virtual machine environment to prevent accidental infection of your host system.

What tools are needed for this skill?

Users should have access to .NET decompilers like dnSpy or ILSpy, Python 3.9+, and deobfuscation tools like de4dot for effective analysis.

What is Agent Tesla RAT?

Agent Tesla is a prevalent .NET-based Remote Access Trojan (RAT) designed to steal credentials and log keystrokes, often exfiltrating data via email or web APIs.

Agent Tesla RAT Config Extractor

Name: Agent Tesla RAT Config Extractor
Author: micsapp

bymicsapp

0•

Security & Testing

Extract embedded configurations and exfiltration credentials from Agent Tesla RAT samples using .NET decompilation and automated string analysis.

This skill provides specialized knowledge and automated scripts for analyzing Agent Tesla, a prominent .NET-based Remote Access Trojan. It enables security researchers and incident responders to deobfuscate .NET assemblies, identify decryption routines, and extract critical Indicators of Compromise (IOCs). By targeting specific exfiltration methods like SMTP, FTP, Telegram, and Discord, this skill streamlines the process of recovering stolen credential destinations and C2 endpoints from malware samples in controlled, isolated environments.

Key Features

010 GitHub stars

02Detection of SMTP, FTP, Telegram, and Discord exfiltration patterns

03Support for deobfuscation workflows using dnSpy and de4dot

04Identification of keylogger settings and targeted application lists

05Python-based automated decryption for XOR and AES obfuscated strings

06Automated .NET string and metadata heap extraction

Use Cases

01Analyzing malware artifacts during security incident response

02Conducting authorized red team exercises and threat research

03Building network-level detection signatures based on extracted C2 endpoints

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills extracting-config-from-agent-tesla-rat

For use in Claude.ai and ChatGPT

Key Features

010 GitHub stars

02Detection of SMTP, FTP, Telegram, and Discord exfiltration patterns

03Support for deobfuscation workflows using dnSpy and de4dot

04Identification of keylogger settings and targeted application lists

05Python-based automated decryption for XOR and AES obfuscated strings

06Automated .NET string and metadata heap extraction

Use Cases

01Analyzing malware artifacts during security incident response

02Conducting authorized red team exercises and threat research

03Building network-level detection signatures based on extracted C2 endpoints

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills extracting-config-from-agent-tesla-rat

For use in Claude.ai and ChatGPT