New Agent Tesla Variant Employs Emoji Obfuscation for Evasion
A new variant of the Agent Tesla information-stealing malware, version 4, has been identified using advanced evasion techniques, including emoji-based code obfuscation, to bypass security defenses.
A recently identified variant of the Agent Tesla information-stealing malware, designated version 4, is employing sophisticated evasion tactics to bypass security defenses and exfiltrate sensitive data. Cybersecurity firm KnowBe4 has detailed the malware's operations, noting its deployment via a targeted business email compromise (BEC) lure aimed at finance departments.
The most striking new feature of Agent Tesla v4 is its use of Unicode emoji characters interleaved within its JScript dropper code. This novel obfuscation technique disrupts string-based signature matching and makes the code visually noisy, hindering both automated detection and manual analysis. The JScript dropper, when executed, writes two files to a public directory, with one serving as a decoy before passing the malicious payload to a DonutLoader shellcode for reflective portable executable (PE) injection. This method ensures the final Agent Tesla binary never touches the filesystem, evading file-based scanners.
Beyond its unique obfuscation, Agent Tesla v4 incorporates several other defense evasion capabilities. The malware is intentionally scrambled using the ConfuserEx obfuscator, rendering it difficult to analyze. Its assembly metadata is disguised as a Python installer, and it employs a standard Windows function to detect and terminate if running within a debugger. This multi-layered approach aims to thwart reverse engineering efforts and maintain stealth.
Before commencing its credential harvesting operations, Agent Tesla v4 establishes a persistent hardware fingerprint, enabling attackers to track victims consistently even across system reinstalls or IP address rotations. The malware also deploys additional persistence mechanisms, including disabling validation for outgoing connections. This ensures that the malware can communicate with its command-and-control (C2) infrastructure without triggering security alerts or errors, maintaining a low profile.
The malware is engineered to sweep credentials from a wide array of sources, encompassing popular web browsers, messaging platforms, and native Windows credential repositories. Furthermore, Agent Tesla v4 is equipped with keylogging and clipboard monitoring tools, allowing it to capture sensitive user input and copied data. All exfiltrated data is meticulously packaged with a system fingerprint header, which includes details such as the timestamp, username, computer name, operating system, CPU and RAM specifications, public IP address, and a hardware ID.
KnowBe4 researchers observed that the collected credential dump is rapidly exfiltrated to the attacker's FTP server within seconds of execution, with no intermediate staging phase. This swift data exfiltration minimizes the window for detection and interception. The campaign observed utilized a spoofed email address from Metropolitan Bank and Trust Company, a legitimate financial institution, to lend credibility to the BEC lure.
To mitigate the threat posed by this variant, KnowBe4 advises security teams to update their email security rules to detect Agent Tesla before it can harvest credentials. While the emoji-obfuscation tactic is novel, researchers note that it does not survive YARA rules designed to look for specific Unicode code points in conjunction with JScript patterns. A rule matching both the emoji distribution pattern and calls to WScript.Shell or CreateObject would effectively catch this malware family.
This new report details a specific campaign by Agent Tesla v4 that leverages Unicode emojis to obfuscate JScript droppers within business email compromise (BEC) attacks targeting finance teams. The malware, disguised as a banking document, uses these characters to evade detection while Windows Script Host executes the hidden code, ultimately stealing credentials from browsers, email clients, and Windows to facilitate account takeover and financial fraud.