A new variant of the Agent Tesla infostealer, designated version 4, has been identified by KnowBe4 researchers, incorporating enhanced evasion techniques and credential harvesting capabilities. This updated malware was observed in a sophisticated business email compromise (BEC) campaign specifically targeting finance departments.
The attack vector involved an email designed to appear as an internal forwarded thread, spoofing the address of the Metropolitan Bank and Trust Company, a legitimate commercial bank based in the Philippines. Recipients were instructed to review an attached document and reply, creating a sense of urgency and legitimacy.
Upon execution, the malware utilizes a JScript dropper, which is notable for its novel obfuscation method. The script's body is interleaved with Unicode emoji characters, such as hearts and water droplets. This technique aims to disrupt string-based signature matching by security tools and make manual code review more challenging due to visual noise.
When launched, the JScript dropper writes two files to `C:\Users\Public\Libraries\`. One of these files serves as a misdirection, while the other is passed into DonutLoader shellcode for reflective portable executable (PE) injection. This method ensures that the final Agent Tesla binary never touches the filesystem, thereby evading detection by file-based scanners.
Agent Tesla v4 also employs several other defense evasion mechanisms. It is intentionally scrambled using an obfuscator tool called "ConfuserEx," making its code difficult to analyze. The malware's assembly metadata is also designed to present itself as a Python installer. Furthermore, it incorporates a standard Windows function as a preliminary defense to detect debuggers and will cease execution if one is found, preventing analysis.
Before initiating credential harvesting, the malware generates a persistent hardware fingerprint. This allows attackers to track victims even across operating system reinstalls or IP address changes. Additional persistence mechanisms include disabling validation for all outgoing connections, ensuring uninterrupted communication with its command-and-control (C2) infrastructure without triggering security alerts.
The infostealer is designed to sweep credentials from over 40 applications, encompassing web browsers, messaging platforms, and native Windows credential repositories. It also includes keylogger and clipboard monitoring functionalities. All exfiltrated data, which includes a system fingerprint header containing a timestamp, username, computer name, OS name, CPU, RAM, public IP, and MD5 hardware ID, is rapidly exfiltrated to a single attacker-controlled FTP server within seconds of execution, without any delayed staging.
KnowBe4 researchers suggest that while the emoji-obfuscation tactic in the JS dropper is novel, it can be mitigated. They advise that YARA rules specifically looking for the Unicode code points used in conjunction with JScript-specific patterns, such as `WScript.Shell` or `CreateObject` calls, should be effective in detecting this malware family. Security teams are recommended to update their email security rules to intercept Agent Tesla before it can harvest credentials.
