AgentTesla Stealer Activates Three-Year-Old Tanzanian Domain in Single Day

A Three-Year Wait, Then Everything at Once

On the morning of 2 June 2026, two events occurred in close enough succession to rule out coincidence. At 12:23:47 UTC, a 90-day wildcard TLS certificate was issued by Let's Encrypt — issuer CN=YR1, serial 5fe3baf35c3534571f8e352115b86a4e57b — covering every possible subdomain of hhautoinvestment.co.tz, a Tanzanian-registered domain that had sat dormant since its registration on 24 August 2023. Within hours of that certificate being minted, a packed .NET credential-harvesting executable was submitted to threat-intelligence infrastructure for the first time, carrying the same domain as its exfiltration endpoint. The domain had waited nearly three years. The operator activated it, certified it, and deployed a payload against it on a single calendar date.

That synchronisation is the operational signature of this campaign. The malware family at its centre — AgentTesla, a long-documented MSIL stealer — is not novel. The infrastructure around it is. CTX Team's analysis of the cluster, tracked under identifier CTXk3nbzqo2tb, reveals a self-contained hosting and mail stack built on a single IP address, a registrar that appears on no other domain in the cluster, and a wildcard certificate that grants the operator the ability to stand up arbitrary subdomains without issuing new credentials. Sixteen industries across six countries fall within the campaign's apparent targeting aperture, from manufacturing and healthcare to telecommunications and wholesale. The breadth is consistent with opportunistic credential harvesting, but the infrastructure discipline suggests an operator who plans further ahead than the typical commodity stealer campaign.

The Infrastructure Fingerprint: REG-KILIHOST, a Dormant ccTLD, and a Single Controlling IP

The domain hhautoinvestment.co.tz was registered on 24 August 2023 through REG-KILIHOST, a registrar that does not appear on any other domain in the cluster — an immediately anomalous detail when registrar concentration is typically the first cross-IOC binding axis. The domain's nameservers delegate to ns1.nextbyte.co.tz and ns2.nextbyte.co.tz, anchoring the infrastructure within Tanzanian hosting fabric, and its A-record resolves to the single IP 91.204.209.32.

What makes this cluster operationally distinctive is not any one of those facts in isolation but the degree to which the operator has consolidated control into a single node. The domain's MX record points to hhautoinvestment.co.tz itself rather than to a third-party mail relay — a self-referential configuration that eliminates external mail-service dependencies and keeps the operator's sending capability entirely within their own infrastructure. The SPF TXT record reinforces this: v=spf1 ip4:91.204.209.32 include:spf.hostns.io +a +mx -all explicitly authorises 91.204.209.32 as a permitted mail sender, confirming that the hosting IP and the mail-sending capability are co-located on the same node. For a campaign deploying a commodity stealer, this is an unusual degree of infrastructure consolidation — most AgentTesla operators rely on free SMTP relays or compromised mail accounts rather than building a self-hosted stack.

The TLS certificate issued on 2 June 2026 carries two features worth noting independently. First, it is a wildcard certificate — its Subject Alternative Names cover both hhautoinvestment.co.tz and *.hhautoinvestment.co.tz — meaning the operator can instantiate any subdomain prefix without returning to Let's Encrypt for a new certificate. The observed FTP subdomain (ftp.hhautoinvestment.co.tz, listed as a URL IOC) is one such instantiation; others could be stood up silently within the certificate's validity window. Second, the certificate has an 89-day lifespan, expiring on 31 August 2026 at 12:23:46 UTC — a short-lived credential that limits exposure if the certificate is flagged or revoked, but also one that requires active renewal to sustain the campaign beyond late August.

The domain was last modified on 2026-06-15, thirteen days after the initial activation, suggesting the operator was actively maintaining the infrastructure during the campaign's observed window (first_seen 2026-06-01, last_seen 2026-06-18). Three vendors — Sophos, Webroot, and alphaMountain.ai — have categorised the domain as phishing and fraud or suspicious, but its overall detection ratio of 15 of 91 network-layer controls means it remains below the blocking threshold for the substantial majority of perimeter defences. The domain's creation date is anchored by the WHOIS registration of 24 August 2023; freshness claims should be read against that date as the earliest confirmed reference point rather than a definitive origin.

No cross-certificate serial linkage to other domains was identified. The infrastructure cluster is isolated — a single domain, a single IP, a single registrar — which simultaneously limits the ability to map broader operator infrastructure and underscores how self-contained the operational model is.

The Payload: A Packed Loader Wearing a Courier-Management Disguise

The single file available for full analysis — SHA256 fc4ba40128ee5df9caaa25bafe1a3d6619f208b2bd206f564267298a0294328f, submitted on 2026-06-02 under the name LXHu.exe — is a PE32 GUI executable compiled as a .NET/MSIL assembly, weighing in at approximately 1,077 KB. It is unsigned, which removes the code-signing axis as a cross-file binding mechanism, but its internal product metadata carries a detail that may be relevant to the campaign's targeting logic: the product name is listed as "CourierExpress," and the copyright string reads in Uzbek — "Kuryer Express — Shahar yetkazib berish boshqaruv tizimi," translating roughly to "Courier Express — City delivery management system." The file version is 1.0.0.0, and the PE compilation timestamp is recorded as 2026-06-01, one day before first submission — consistent with a freshly built binary rather than a recycled one.

The binary is packed with PEiD. Its .text section registers entropy at 7.77 — approaching the theoretical maximum of 8.0 and well above the threshold that distinguishes compressed or encrypted content from plaintext code. The .rsrc section, by contrast, sits at 3.47, and the .reloc section at 0.10, a distribution that is structurally consistent with a loader stub: a small, low-entropy resource section carrying minimal legitimate metadata, and a single massively entropic .text section containing the encrypted or compressed payload waiting to be decrypted at runtime. The import count is zero, which is characteristic of .NET assemblies that resolve their imports through the CLR rather than the PE import table — and which also means the imphash (f34d5f2d4577ed6d9ceec516c1f5a744) reflects only the loader's own minimal PE structure rather than the full stealer's dependency profile.

All three sandbox environments that processed the sample returned malicious verdicts. Zenbox assigned a confidence of 100, classifying the file as MALWARE, STEALER, TROJAN, and EVADER, and named AgentTesla as the family. C2AE returned a confidence of 70, classifying it as STEALER and naming AgentTesla, AgentTesla2, BrowserStealerGeneric, and KeyloggerGeneric — the last two names suggesting that the sandbox observed both passive keystroke capture and active credential extraction from browser stores during the analysis window. Yomi Hunter returned a malicious verdict without a named family. The sandbox consensus is unambiguous: 3 of 3 environments, 0 suspicious, 0 clean.

On the AV side, 50 of 75 engines flag the sample, leaving 17 engines without a detection at time of analysis. The missing engines include Acronis, ClamAV, Cynet, and Xcitium — a mix of enterprise endpoint products and open-source scanning tools. The community vote stands at 1 malicious, 0 harmless, and the file carries a VirusTotal reputation of -1. Eleven Sigma rules from the GitHub integrated rule set match the sample (two at high severity, eight at medium, one at low), and three Proofpoint Emerging Threats Open IDS rules fired — a detail that becomes significant when the execution chain is examined in full.

The file's alternate names — C:\Users\user\AppData\Roaming\DUzpSN.exe and C:\Windows\jw9qy9.exe — are not delivery names but post-execution persistence paths, indicating the sample was observed copying itself to both user-writable and system-level locations during sandbox analysis.

Execution Under Cover: Evasion Layers Before the Stealer Wakes

The execution chain documented in sandbox telemetry follows a sequence that is characteristic of mature AgentTesla deployments but is executed here with a layered thoroughness that goes beyond the minimum viable evasion stack. The chain can be read in five ordered stages, each evidenced by distinct artefacts.

The loader's first priority after execution is environmental validation. Before decrypting or injecting the core stealer payload, it performs a series of checks designed to determine whether it is running in a real victim environment or an analysis sandbox. The file carries the tags checks-bios, detect-debug-environment, and checks-network-adapters, and MITRE techniques T1497 (Virtualization/Sandbox Evasion), T1497.001 (System Checks), T1497.003 (Time-Based Evasion), and T1622 (Debugger Evasion) are all mapped in the telemetry. The BIOS string check is a well-documented technique for detecting virtualisation platforms that expose vendor strings like "VBOX" or "VMWARE" in firmware identifiers; the network adapter check similarly looks for virtual NIC MAC address prefixes associated with hypervisors. The long-sleeps tag indicates the sample also introduces extended sleep delays — a time-based evasion technique [T1497.003] that defeats sandbox environments operating under strict time budgets by simply waiting out the analysis window before activating.

If the environment passes these checks, the loader proceeds to inject the core AgentTesla payload into a host process. MITRE techniques T1055 (Process Injection), T1055.003 (Thread Execution Hijacking), and T1055.012 (Process Hollowing) are all mapped in the telemetry. Process hollowing [T1055.012] involves creating a legitimate host process in a suspended state, unmapping its memory, and replacing it with the malicious payload before resuming execution — a technique that, as the MITRE framework notes, masks "execution under a legitimate process" to evade process-based defences. The combination of PEiD packing, near-maximal .text entropy, and the EVADER classification from Zenbox is structurally consistent with this model: the loader stub decrypts the AgentTesla payload in memory and injects it into a host process rather than writing the decrypted payload to disk, limiting the forensic footprint available to endpoint detection tools.

Persistence is established through two parallel mechanisms. The sample copies itself to C:\Users\user\AppData\Roaming\DUzpSN.exe and C:\Windows\jw9qy9.exe — the former a standard user-writable persistence location, the latter requiring elevated privileges and suggesting the sample may attempt privilege escalation in some execution paths. MITRE T1547.001 (Registry Run Keys / Startup Folder) and T1112 (Modify Registry) are both mapped, indicating that a registry Run key is written to ensure the payload survives system reboots. The persistence tag in the file's VirusTotal metadata corroborates this. The spreader tag is also present, though no specific lateral movement mechanism was observed — this should be treated as an unconfirmed signal rather than a confirmed capability.

The credential-access phase activates AgentTesla's harvesting modules across multiple target surfaces simultaneously. MITRE T1555.003 (Credentials from Web Browsers) maps to the BrowserStealerGeneric sandbox family name, indicating active extraction from browser credential stores — Chrome, Firefox, Edge, and similar applications all maintain credential databases that AgentTesla is documented to target. T1552.001 (Credentials in Files) and T1552.002 (Credentials in Registry) extend the harvest to file-system and registry-stored credentials, covering applications that store authentication material outside browser databases. T1087.003 (Email Account Discovery) maps to the KeyloggerGeneric and broader stealer behaviour, consistent with AgentTesla's documented capability to extract credentials from mail clients including Outlook, Thunderbird, and similar applications. The calls-wmi tag suggests Windows Management Instrumentation is used during the discovery phase, potentially for process enumeration [T1057] or system configuration queries [T1012] that help the stealer identify installed applications worth targeting.

The ip-api.com Gate: Screening Victims Before Exfiltration

The most operationally revealing behavioural signal is not the credential theft itself but the step that precedes it. Before transmitting any harvested data, the AgentTesla implant queries ip-api.com to obtain the victim machine's external IP address and determine whether that address belongs to a hosting provider. Three Proofpoint Emerging Threats Open IDS rules fired on this behaviour: "ET MALWARE Common Stealer Behavior — Source IP Associated with Hosting Provider Check via ip.api.com" (high severity), "ET POLICY External IP Lookup ip-api.com" (medium severity), and "ET INFO External IP Lookup Domain in DNS Lookup (ip-api.com)" (medium severity). MITRE T1016 (System Network Configuration Discovery) is mapped in the telemetry.

The operational logic of this check is straightforward but significant. Sandbox environments and security researcher workstations typically resolve to IP ranges owned by cloud providers, hosting companies, or known security vendors. By querying ip-api.com — a legitimate geolocation API that returns the ASN and organisation name associated with an IP address — the implant can determine whether the machine it is running on belongs to a hosting provider before committing to exfiltration. If the check returns a hosting-provider ASN, the implant can suppress the exfiltration attempt entirely, reducing the volume of traffic that reaches the operator's infrastructure from non-victim sources and making it harder for researchers to trigger and observe the full exfiltration flow in controlled environments.

This is a well-documented AgentTesla behaviour pattern, and the three ET rule hits confirm it was active in this sample's sandbox execution. The high-severity classification of the primary rule — "ET MALWARE Common Stealer Behavior" — reflects Proofpoint's assessment that this specific ip-api.com query pattern is a reliable indicator of stealer activity rather than a generic policy concern. The two medium-severity rules capture the DNS and HTTP layers of the same query, providing multiple detection opportunities at the network perimeter for defenders who have deployed Emerging Threats signatures.

Once the environmental check passes, harvested credentials are exfiltrated over FTP to ftp.hhautoinvestment.co.tz [T1071.002, T1048]. The FTP subdomain is listed as a URL IOC, and the combination of the wildcard TLS certificate (which covers *.hhautoinvestment.co.tz, including the ftp. prefix), the self-hosted mail stack, and the MITRE T1048 (Exfiltration Over Alternative Protocol) mapping creates a coherent picture: the operator receives stolen credentials at the same infrastructure node that hosted and delivered the payload, completing a fully self-contained operational loop. FTP as an exfiltration channel carries a practical advantage for the operator — many perimeter controls prioritise HTTP/S inspection over FTP traffic, and FTP sessions to a domain with a valid TLS certificate may pass through network monitoring with less scrutiny than raw HTTP beaconing.

The Targeting Surface: Sixteen Industries, Six Countries, One Uzbek Lure

The campaign's targeting aperture spans sixteen industry verticals across six countries: the United Arab Emirates, Germany, Denmark, Japan, Liechtenstein, and Turkey. The industry list covers arts and entertainment, automotive, business associations, chemicals, construction, engineering, healthcare, hospitality and leisure, manufacturing, media, non-profit organisations, support services, technology, telecommunications, transportation, and wholesale. This breadth is characteristic of opportunistic credential-harvesting campaigns that cast wide nets rather than pursuing specific high-value targets — AgentTesla operators typically monetise stolen credentials through bulk resale, business email compromise enablement, or account takeover across whatever organisations happen to open the phishing lure.

The geographic spread is similarly diffuse. Germany, Japan, and Turkey represent large economies with substantial manufacturing and technology sectors; the United Arab Emirates and Denmark add financial and logistics exposure; Liechtenstein's inclusion, as a small but financially significant jurisdiction, may reflect targeting of financial services or corporate administration personnel. None of these country selections individually suggests a geopolitical targeting rationale, and no actor attribution is available, meaning alignment with a state-sponsored program cannot be assessed from the current evidence.

The Uzbek-language lure metadata embedded in the payload — the "CourierExpress" product name and the "Kuryer Express — Shahar yetkazib berish boshqaruv tizimi" copyright string — is the one targeting signal that cuts against the purely generic interpretation. Uzbekistan is not among the listed target countries, but the lure's framing as a courier-management application is consistent with targeting logistics, supply-chain, or transportation-sector personnel who might plausibly receive or seek out such software. The transportation industry is explicitly listed in the campaign's targeting metadata. Whether the Uzbek-language string reflects the operator's own linguistic background, a deliberate targeting choice aimed at Uzbek-speaking logistics personnel in the listed countries, or simply a reused builder template from a previous campaign is not determinable from the current evidence — but it is a detail that distinguishes this sample from generic English-language lures and may be relevant to future attribution analysis if additional samples surface.

Two additional file SHA256s appear alongside the primary sample — a230a78a48ec16b4fab7a2f95985decdef8b003b90748b0ef9ffd331baa3c2ee and 5d57dde9b29f152f03ac7ada4132fedc9068653daac5889968f3d48fedcbe784. Current evidence is too thin to characterise these files. They may represent additional loader variants, second-stage payloads dropped by the primary sample, or unrelated files bundled in the same feed submission. Their presence means the campaign's true file footprint is larger than the single enriched sample, and the technical complexity of the operation may be materially underestimated by an analysis that treats fc4ba401 as the complete picture. Until further data is available for these two SHA256s, cross-file clustering on imphash, vhash, or signer axes is not possible.

Infrastructure Discipline in a Commodity Stealer Campaign: What the Activation Pattern Signals

The most analytically significant aspect of this campaign is the gap between its tooling and its infrastructure behaviour. AgentTesla is a commodity stealer available through criminal marketplaces and well-documented across years of public reporting. Operators deploying it typically rely on equally commodity infrastructure: free email services, compromised hosting accounts, or short-lived domains registered days before use. The infrastructure profile documented here diverges from that pattern in ways that are worth examining carefully.

A domain registered in August 2023 and left dormant until June 2026 represents a deliberate pre-registration strategy. Aged domains carry practical advantages: they accumulate passive reputation with domain-age-based filtering systems, they avoid the "newly registered domain" detection signatures that many email security gateways apply to domains less than thirty days old, and they can be activated on short notice without triggering the registration-event monitoring that some threat intelligence platforms use to flag fresh phishing infrastructure. The three-year dormancy period here is longer than typical aged-domain strategies, which more commonly involve six-to-twelve month aging windows. Whether this reflects careful long-term planning, a domain acquired from a previous operator, or simply a registration that sat unused until an operational need arose is not determinable from the available evidence — but the outcome is the same: a domain with a 2023 registration date arriving at victim mail gateways in June 2026.

The self-contained mail and hosting stack on 91.204.209.32 eliminates the third-party dependencies that most commodity stealer operators accept as a cost of low-effort infrastructure. Third-party SMTP relays and free hosting services introduce operational risks: account suspension, abuse reporting, and provider-side takedowns. By controlling both the hosting IP and the mail-sending capability from a single node, the operator retains full operational continuity unless 91.204.209.32 itself is blocked or the REG-KILIHOST registration is disrupted. That consolidation is a double-edged design choice — it creates a compact but fragile single point of failure, where disruption of the IP or the registrar relationship would sever the entire operational chain simultaneously.

The wildcard certificate adds a layer of forward flexibility. The operator can instantiate new subdomains — for additional payload hosting, alternative exfiltration endpoints, or phishing landing pages — without generating new certificate issuance events that might trigger monitoring. The 89-day validity window means the certificate expires on 31 August 2026; if the campaign is still active at that point, a renewal event will be observable in certificate transparency logs, providing a potential detection opportunity.

The two additional file SHA256s represent the most significant unresolved uncertainty in the current analysis. If they are additional loader variants or second-stage payloads — rather than noise or unrelated submissions — then the single enriched sample may be only one component of a more complex toolchain. The spreader tag on fc4ba401 is a further unresolved signal: if the sample has lateral movement capability, the campaign's impact surface within compromised organisations could extend beyond the initial credential harvest. Neither of these possibilities can be confirmed from the current evidence, but both would, if confirmed, shift the assessment of this campaign from opportunistic commodity operation toward something with greater operational depth.

What the activation pattern ultimately signals is an operator who invests in infrastructure preparation at a level that exceeds what the commodity nature of the payload would predict. The combination of aged-domain strategy, self-hosted mail stack, wildcard TLS coverage, and same-day coordinated activation suggests operational discipline that is more commonly associated with targeted intrusion campaigns than with bulk credential-harvesting operations. Whether that discipline reflects a single skilled operator, a small team with defined infrastructure and payload roles, or a criminal-as-a-service arrangement where infrastructure preparation is handled separately from payload deployment cannot be determined from the current evidence. What is clear is that the infrastructure fingerprint — REG-KILIHOST, 91.204.209.32, ns1.nextbyte.co.tz, the wildcard Let's Encrypt certificate issued at 12:23:47 UTC on 2 June 2026 — is more distinctive and more durable as a detection anchor than the AgentTesla payload itself, which will continue to evolve and be repacked while the infrastructure investment the operator made in 2023 remains observable in WHOIS, DNS, and certificate transparency records.