Agent Tesla: A Fake Purchase Order That Steals Logins Over Plain FTP

An Agent Tesla campaign hides a Spanish purchase order in an archive with a .uu extension, then steals logins and sends them out over plain FTP.

Agent Tesla is a spyware Trojan written for the .NET framework that MITRE ATT&CK says has been observed since at least 2014. Process hollowing means starting a legitimate program in a suspended state, writing attacker code into its memory and resuming it, so the malware runs under a trusted name. FTP exfiltration means the stolen data leaves over File Transfer Protocol, which sends credentials and files without encryption.

Analysis based on ANY.RUN research published on 14 May 2026, which began with a sample found in March 2026. The same hiding place has appeared in Threat Watch before, in a Formbook campaign that hid inside the same Windows process, aspnet_compiler.exe.

How does Agent Tesla hide inside aspnet_compiler.exe?

ANY.RUN describes one chain from the archive to the FTP upload. Steps 1 and 2 are the delivery and the script; steps 3 to 5 are the loader, the injection and the in-memory payload; step 6 is the theft.

1. An accounts payable or procurement employee receives a Spanish-language purchase order. The analysed attachment is Orden de compra_pdf.uu, a RAR archive. ANY.RUN's evidence line says the archive was delivered by email and publishes no sender details.
2. Extracting the archive gives a JScript Encoded file that wscript.exe runs. It downloads a decoy PDF to distract the victim, writes PowerShell stager scripts with random names into C:\Temp\, runs them with execution policy bypass and changes registry keys for persistence.
3. A PowerShell stager loads ALTERNATE.dll, the Agent Tesla loader. The DLL is protected with .NET Reactor 6.x, and ANY.RUN lists a forged PE timestamp of 2066 among the protections.
4. The stager finds aspnet_compiler.exe, a legitimate .NET Framework component, and starts it suspended. It then allocates memory in it (VirtualAllocEx), writes the payload (WriteProcessMemory), resolves the entry point and resumes the thread.
5. The loader reads an AES-256 encrypted and compressed blob from its resources, decrypts it with a hardcoded key, decompresses it and loads Agent Tesla from a byte array in memory. ANY.RUN says no file is written to disk from this point forward.
6. Agent Tesla collects credentials, keystrokes, clipboard text and screenshots into an HTML report named PW_[username]-[hostname]_[timestamp].html and uploads it over cleartext FTP to the compromised server.

What a defender sees at each stage

The table lists what runs at each step and why a quick check passes it. It is AegisAI's reading of the reported chain.

What the stealer targets

ANY.RUN reports that the unpacked payload targets more than 80 applications across six categories. It also runs a keylogger and a clipboard monitor, and the HTML report includes system details and base64-encoded screenshots.

The reported timeline

How do I detect Agent Tesla process hollowing and FTP exfiltration?

Detect the chain, not the file name. ANY.RUN recommends interactive sandbox analysis for suspicious attachments and monitoring of outbound FTP, because static scanning and process names show little here.

Four signals from the report make workable hunting rules:

• wscript.exe running a JScript Encoded file, followed by PowerShell with execution policy bypass that runs randomly named scripts from C:\Temp\.
• aspnet_compiler.exe started suspended by PowerShell or another unexpected parent, with memory allocated and written in it. AegisAI's reading is that this is rare outside .NET development hosts.
• A workstation opening an outbound FTP connection (port 21 by default) to an unfamiliar host and sending a file whose name starts with PW_. ANY.RUN published a Suricata rule that matches the STOR PW_ command.
• A new Run key value, a copy in the Startup folder or a scheduled task, with the GUID-named copy 7bcd610d-7af6-4dc2-875b-dc4fec91463c.exe in the sample.

The FTP host is a compromised legitimate site, so ANY.RUN notes that blocking the IP address may affect a real business. The report also lists related subdomains on the same IP used as email relay infrastructure, patterns it calls consistent with mail relay abuse to improve phishing deliverability.

What this means for a security team

This section is AegisAI's analysis. ANY.RUN describes purchase orders as expected, frequently shared by email and often opened without scrutiny by accounts payable and procurement staff, which is why the lure fits that desk. The campaign is also old: the same FTP server has been in use since September 2024 while the file names changed, so an indicator list from one week does not cover the next.

Three questions settle the exposure: whether archives with unusual extensions and script types such as .jse and .vbe reach finance and procurement inboxes, whether anyone watches outbound FTP from workstations, and whether credentials saved in browsers, mail clients, FTP clients and VPN clients can be reset quickly for a user who opened the archive.

Why standard controls miss it

This section is AegisAI's analysis. An extension filter has no rule for .uu, a static scanner meets a protected loader and a payload that never reaches disk, and a process-name check sees only Windows tools. The exfiltration then uses a protocol that many egress controls leave alone and a destination with a clean history. The remaining signal is the request itself: a purchase order that holds an archive with an odd extension, sent to someone whose job is to open purchase orders. That request is visible when the email arrives.

How AegisAI protects against it

AegisAI has not observed this campaign. ANY.RUN's evidence line says the archive was delivered by email but publishes no sender or volume details, so the approach below is how AegisAI treats an archive lure of this shape when it arrives by email. It does not cover what happens on an endpoint after the archive is opened, or the FTP traffic that follows.

AegisAI's agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it. More on how that works: inbound email security.

When a lure or a compromised session is caught, the response compounds: the message is withheld at classification, copies already delivered are retracted, rewritten links refuse a late visit, the account's outbound and internal mail gets rescanned, and lateral phishing attempts to colleagues are blocked at the same bar rather than treated as a fresh, unrelated message.

See a purchase order lure like this investigated How inbound protection works

How AegisAI stops credential phishing, 48 seconds

Recommendations for defenders

• Quarantine archives with unusual extensions such as .uu, script files such as .jse and .vbe inside archives, and macro-enabled Office files such as .xlam from external senders in procurement mail, as ANY.RUN advises.
• Add detections for wscript.exe followed by PowerShell with execution policy bypass, and for aspnet_compiler.exe started suspended by an unexpected parent.
• Allow outbound FTP only from known servers. Alert on a workstation that connects to an unfamiliar FTP host or sends a file named PW_, and pivot on the reported IP address and host name in threat intelligence tools.
• Detonate suspicious attachments in an interactive sandbox in addition to static scanning, because the loader is built to defeat static analysis.
• Brief procurement, finance and HR staff that a purchase order is not an archive. Where a user opened one, isolate the host and reset the browser, mail, FTP and VPN credentials saved on it.

FAQ