Hackers have adopted a novel tactic to conceal malicious software, employing Unicode emojis to disguise an Agent Tesla JScript dropper in emails targeting finance departments. This innovative approach transforms a seemingly straightforward attachment into an intricate script, maintaining harmful instructions ready for execution on Windows systems.
Details of the Attack
The scheme involves a deceptive email purporting to be from Metropolitan Bank and Trust Company, requesting recipients to verify an attached document. The attachment, misleadingly labeled as a SWIFT payment file, is a 6.94 MB JavaScript file that initiates a sequence to hide the final credential-stealing software on the victim’s computer.
Researchers from KnowBe4 have tracked this campaign, identifying it as part of the ongoing Agent Tesla v4 operations. The malware not only steals passwords but also gathers browser credentials, email logins, messaging data, and Windows secrets, posing significant risks of account takeovers and further phishing attacks.
Technical Concealment Techniques
In a bid to avoid detection, the JScript file is filled with various Unicode emoji characters, such as hearts and water droplets. While these characters are ignored by Windows Script Host, they serve to obscure the code visually and complicate simple text-based detection methods.
This method is more than a mere file format trick. By embedding emojis, the attackers create a discrepancy between what security analysts or filters see and what the system ultimately executes. Upon opening the attachment, the dropper writes a disguised file to the public Libraries folder and uses DonutLoader shellcode to load the final payload in memory, minimizing the risk of detection by file-based scanners.
Implications and Recommendations
The campaign does not rely on secondary downloads, making the initial attachment crucial for defenders to intercept. Analysts discovered that the final payload is masquerading as a Python installer, although it is actually a 32-bit .NET 4.0 binary. This mismatch, alongside the script’s size and payment lure, serves as a clue for security teams.
Agent Tesla conducts checks to evade detection, such as verifying if it’s operating in a virtual environment or under scrutiny. Once active, it targets credentials from numerous browsers and email clients. Organizations should implement stringent controls over script attachments, particularly .JS files, and enhance email security measures against spoofed brands and forwarded lures.
Security teams are advised to monitor for JScript-specific behavior and unusual Unicode usage rather than relying solely on file signatures. Investigating systems that connected to the listed infrastructure and resetting all accessible credentials is crucial. Continuous vigilance and adjusting detection strategies can help mitigate the impacts of such sophisticated cyber threats.
