New Agent Tesla Malware Variant Boosts Evasion Capabilities

New Agent Tesla Malware Variant Boosts Evasion Capabilities 🚀

A new version of the notorious Agent Tesla malware contains features designed to evade detection and steal credentials, as identified by KnowBe4 research. This detailed analysis of the Agent Tesla version 4 infostealer reveals that it was observed being dropped via a sophisticated business email compromise (BEC) lure targeting finance departments.

The malware employs a novel obfuscation technique using Unicode emoji characters embedded throughout the code body. The final payload is configured to sweep credentials from over 40 applications and rapidly exfiltrate them to a single threat actor-controlled domain.

Key Findings 🔍

• The attempted delivery of Agent Tesla v4 was observed in an email that appeared as internal correspondence, spoofing a legitimate bank’s address.
• The malware operates via a Jscript dropper, which can be launched with a simple open-with dialog. The script body contains various Unicode emoji characters, disrupting string-based signature matching and making the code visually noisy.
• Once launched, the script writes files to C:\Users\Public\Libraries**, leading to reflective **PE injection. This means the final Agent Tesla binary never touches the filesystem, evading detection by file-based scanners.
• Agent Tesla v4 includes defense evasion capabilities, scrambling its code with an obfuscator tool called ConfuserEx to make it nearly unreadable.
• It creates a persistent hardware fingerprint, allowing attackers to track victims consistently across reinstalls or IP rotations.
• The malware is capable of intercepting keystrokes and sweeping credentials from various sources, including web browsers and messaging platforms.

KnowBe4 noted that the credential dump lands on the attacker’s FTP server within seconds of execution, with no delayed staging. The emoji-obfuscation approach in the JS dropper does not survive any YARA rule that looks for the Unicode code points used alongside JScript-specific patterns.

For more details, check out the full article: Read full article