Agent Tesla Malware Hides in Unicode Emojis to Evade Detection
Key Takeaways Cybercriminals are leveraging Unicode emojis to obfuscate an Agent Tesla JScript dropper in a new business email compromise (BEC) campaign. The attack primarily targets finance teams...
Key Takeaways
- Cybercriminals are leveraging Unicode emojis to obfuscate an Agent Tesla JScript dropper in a new business email compromise (BEC) campaign.
- The attack primarily targets finance teams with urgent, payment-related phishing emails impersonating Metropolitan Bank and Trust Company.
- The obfuscation technique allows malicious JScript to appear as benign or unreadable code, bypassing some traditional security detections.
- Agent Tesla v4, a sophisticated information stealer, is delivered through a multi-stage, in-memory process, making it harder to detect on disk.
- The malware aims to harvest a wide range of credentials, including browser logins, email accounts, messaging data, and Windows secrets, posing a significant risk for financial fraud and further attacks.
Hackers Deploy Agent Tesla with Unicode Emoji Camouflage to Evade Detection
A recent business email compromise (BEC) campaign is exploiting Unicode emoji characters to conceal an Agent Tesla JScript dropper, specifically targeting finance departments within organizations. This novel obfuscation technique transforms a seemingly innocent payment-related attachment into a script that is difficult for human analysts and some automated systems to interpret, while remaining fully executable by Windows.
Table Of Content
The attack begins with a deceptive wire-transfer email, carefully crafted to impersonate the Metropolitan Bank and Trust Company. The email employs social engineering tactics, including a sense of urgency and a plausible banking context, to persuade recipients to open a substantial 6.94 MB JavaScript file. This initial interaction is critical, as it triggers a complex infection chain.
Researchers at KnowBe4 said in a report that they have identified this activity as an Agent Tesla v4 operation. The attachment, disguised as a SWIFT payment document, initiates a sequence designed to keep the final credential-stealing payload hidden from disk-based security scans. The potential impact of this malware extends far beyond a single compromised password, capable of exfiltrating browser logins, email credentials, messaging application data, and Windows secrets, thereby providing attackers with ample material for account takeovers, subsequent phishing attempts, and payment fraud.
The Art of Emoji Obfuscation
The core of this evasion strategy lies in the use of Unicode emoji characters embedded within the JScript file. While Windows Script Host is designed to disregard these characters during script parsing, their presence creates significant visual clutter. This visual noise can effectively hinder quick manual reviews and undermine basic text-signature-based detection rules employed by security tools.
This method is more than a simple file format trick. As detailed in discussions regarding emoji code concealment methods, Unicode can create a significant disparity between what a security analyst or filter observes and what a program ultimately executes. In this particular campaign, the “hidden” code executes without issues once the attachment is opened.
The dropper component of the malware then writes a loader and a file disguised as a font to the public Libraries folder. Subsequently, it employs DonutLoader shellcode to load the final .NET payload directly into memory. This in-memory execution strategy minimizes the forensic footprint on the victim’s disk, making detection challenging for scanners that primarily focus on suspicious files.
Notably, this campaign does not rely on a second-stage download for its payload. This design choice eliminates a potential network detection point, emphasizing the critical importance for defenders to intercept the initial malicious attachment. The final payload deceptively presents itself with program information suggesting it’s a “Python 3.11.3 (64-bit)” installer from the “Python Software Foundation,” although analysis reveals it to be a 32-bit .NET 4.0 binary. Such metadata inconsistencies, coupled with an unusually large script, a payment-related lure, and JScript execution, serve as crucial indicators for threat hunters.
Credential Theft and Defense
Before initiating its information-stealing routines, Agent Tesla performs checks to determine if it is operating within a debugger, a cloud-hosted environment, or a virtual machine. It also scans for software commonly associated with security analysis. If these checks indicate a suspicious environment, the malware terminates to avoid revealing its operational tactics. Once activated, Agent Tesla targets credentials from 27 Chromium-based browsers, 13 Mozilla-based browsers, as well as Outlook, Foxmail, Discord, Thunderbird contacts, and Windows Credential Manager.
This campaign aligns with recent Agent Tesla campaigns, characterized by phishing, heavily obfuscated scripts, and in-memory execution. Captured data is exfiltrated via FTP, and a unique hardware identifier is attached to assist attackers in tracking victims. Although keylogging, clipboard monitoring, and screen-capture functionalities were disabled in the analyzed configuration, these features can be activated in other builds of the malware.
What You Should Do
- Strengthen Email Security: Implement strict policies to block or tightly control script attachments, especially
.JSfiles, particularly in communications related to payments or financial transactions. Regularly review email gateway controls for spoofed brands and forwarded-thread phishing lures. - Verify Payment Requests Independently: Finance teams must establish and adhere to protocols for independently verifying all payment requests through a known, secure contact channel, rather than replying directly to emails. This practice is crucial for early detection of BEC attacks.
- Isolate and Remediate Affected Systems: If a system is suspected of compromise, immediately isolate it from the network. Investigate any hosts that have contacted the identified command-and-control infrastructure.
- Rotate Credentials: Reset all credentials that were accessible on affected systems, including browser, email, Windows Vault, and active messaging account credentials, as the malware’s collection routine executes immediately upon compromise.
- Enhance Detection Capabilities: Security teams should move beyond conventional file signatures and focus on detecting JScript-specific behaviors, especially in conjunction with unusual Unicode code points, as observed in this dropper. Monitor for anomalous in-memory
.NETloading and outbound FTP traffic to cover the multi-stage delivery documented in this Agent Tesla case.
Indicators of Compromise (IoCs)
| Type | Indicator | Description |
|---|---|---|
| Attachment filename | SWIFT Payment Maker 103 - 10.06.26.JS |
Malicious JScript attachment used in the phishing lure |
| SHA-256 | 615f9ecc51ccce0de6e88dcff70662f77965214bf5ad0cc7e07bc4fae72c40d0 |
SHA-256 hash of the malicious attachment |
| Sender impersonation | Metropolitan Bank and Trust Company (Philippines) |
Brand impersonated in the business email compromise lure |
| Dropped file | C:UsersPublicLibrarieswabmmxofrrdsjlsx.exe |
32-bit .NET loader written by the dropper |
| Dropped file |
|
No Comment! Be the first one.