Agent Tesla v4: A Smarter, Sneakier Infostealer
There’s a new version of Agent Tesla malware making the rounds, and it’s brought some tricks that should worry anyone in finance. Researchers at KnowBe4 just published a deep dive on Agent Tesla v4, an infostealer that’s been spotted arriving via a business email compromise (BEC) lure aimed squarely at accounting departments.
The headline feature? Unicode emoji characters scattered through the malicious code. Hearts, water droplets, the works. It sounds almost playful, until you realize what those little symbols are doing: breaking string-based signature matching and making the code noisy enough to slip past casual review.
This isn’t your run-of-the-mill credential stealer. It’s designed to evade detection at every turn, and it’s good at it.
How the Attack Unfolds
The delivery mechanism is a JScript dropper, which can be launched with a simple open-with dialog. The email itself is a forwarded thread, made to look like internal correspondence. The recipient is brought in late, told to confirm an attached document, and reply. Classic social engineering, executed well.
The attackers spoofed the address of Metropolitan Bank and Trust Company, a legitimate Philippines-based commercial bank. The whole thread feels like an in-progress discussion you’ve just been pulled into. That urgency, that sense of being out of the loop—it works.
The Emoji Obfuscation Trick
Once the JScript dropper runs, it writes two files to C:UsersPublicLibraries. One is a decoy. The other passes the payload into DonutLoader shellcode for reflective PE injection. That means the final Agent Tesla binary never touches the filesystem. File-based scanners? Useless.
The emoji characters are interleaved directly through the script body. They disrupt signature matching and make the code visually noisy. A human glancing at it in a text editor sees a mess. An automated scanner sees something it doesn’t recognize. Both are defeated.
KnowBe4’s researchers note that any YARA rule looking for the Unicode code points alongside JScript-specific patterns will catch this family. A rule matching both the emoji distribution pattern and WScript.Shell or CreateObject calls will do it. That’s the mitigation playbook, in a nutshell.
Evasion Techniques That Go Beyond Emojis
The obfuscation doesn’t stop at the dropper. Agent Tesla v4 is scrambled with ConfuserEx, an obfuscator tool that makes the assembly nearly unreadable. Its embedded metadata presents the malware as a Python installer. A little misdirection, a little disguise.
The malware also checks for debuggers using a standard Windows function. If it detects one, it stops running. No analysis, no sample collection, no fun for researchers.
Before harvesting anything, it creates a persistent hardware fingerprint. That lets attackers track victims across OS reinstalls and IP rotations. Even if you rebuild your machine, they know it’s you.
It also disables validation for all outgoing connections, ensuring smooth communication with C2 infrastructure without triggering security alerts or errors. Persistence is the name of the game.
Credential Theft and Data Exfiltration
Once it’s settled in, Agent Tesla v4 sweeps credentials from more than 40 applications. Web browsers, messaging platforms, native Windows credential repositories—it’s all fair game. It also has a keylogger and clipboard tool for intercepting keystrokes and copied text.
All exfiltrated files carry a system fingerprint header: timestamp, username, computer name, OS name, CPU, RAM, public IP, and the MD5 hardware ID. That’s a lot of identifying information, all packaged neatly for the attacker.
The credential dump lands on the attacker’s FTP server within seconds of execution. No delayed staging, no waiting around. The whole operation is fast, efficient, and ruthless.
What Security Teams Should Do
KnowBe4’s advice is straightforward: update email security rules to catch Agent Tesla before it can harvest credentials. The emoji obfuscation doesn’t survive YARA rules that look for the specific Unicode code points used alongside JScript patterns.
For defenders, that means:
- Deploy YARA rules that match emoji distribution patterns combined with WScript.Shell or CreateObject calls.
- Monitor for unusual JScript activity, especially in environments where it’s rarely used.
- Train finance teams to recognize BEC lures, even when they look like internal threads.
- Keep an eye on outbound FTP traffic to unknown domains.
Agent Tesla has been around for years, but this version shows the threat is evolving. Emoji obfuscation is a new twist on an old problem. The fundamentals, though, remain the same: verify before you click, and keep your email filters sharp.
For more on defending against credential theft, check out our guide on phishing email detection best practices and learn how to secure your email gateway against BEC attacks.
CyberSecurity7 months ago
How To6 months ago
How To4 months ago
How To6 months ago
How To5 months ago
How To7 months ago
How To6 months ago