# Agent Tesla v4 Hidden Behind Unicode-Emoji-Obfuscated JScript Evades Detection in BEC Campaign Targeting Finance Teams

> An active Agent Tesla v4 business email compromise campaign impersonates Metropolitan Bank and Trust Company (Philippines) to deliver a 6.94 MB JScript attachment whose code body is saturated with Unicode emoji characters that Windows Script Host silently ignores, defeating string-signature detection. The dropper stages DonutLoader shellcode that reflectively injects a ConfuserEx-obfuscated, Python-metadata-spoofed .NET 4.0 Agent Tesla payload directly into memory, which then harvests credentials from 27 Chromium and 13 Mozilla browsers, Outlook, Foxmail, Thunderbird, Discord, and Windows Credential Manager before exfiltrating over FTP.

- **Published:** 2026-08-22T00:00:00Z
- **Last reviewed:** 2026-08-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2108
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-agent-tesla-v4-emoji-stealer-tl-2026-2108.webp?v=addbae4d (Threadlinqs threat intel: Agent Tesla v4 Emoji-Obfuscated BEC: Detection & IOCs (TL-2026-2108) — High severity, 17 IOCs, 9 detection rules.)
- **ID:** TL-2026-2108
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 17 (3 shown free below)

## Description

KnowBe4 Threat Labs documented an in-the-wild Agent Tesla v4 campaign that pairs a convincing wire-transfer BEC lure with a fileless, multi-stage execution chain. The initial vector is a forwarded-thread phishing email spoofing Metropolitan Bank and Trust Company, a Philippine bank, urging the recipient to confirm an attached 'SWIFT Payment Maker 103 - 10.06.26.JS' file (SHA-256 615f9ecc51ccce0de6e88dcff70662f77965214bf5ad0cc7e07bc4fae72c40d0, 6.94 MB).

The attachment is a JScript dropper whose entire obfuscation layer consists of Unicode emoji characters (hearts, water droplets) interleaved throughout the functional code. Windows Script Host's JScript interpreter parses past these characters as noise while executing the underlying logic untouched, defeating casual analyst review and string-based signature matching. On execution, the dropper writes two files to C:\Users\Public\Libraries\: wabmmxofrrdsjlsx.exe, a 32-bit .NET loader, and wabmmxofrrdsjlsx.ttf, an encoded Agent Tesla payload blob disguised as a font file. The loader reads the .ttf as raw bytes and passes them to DonutLoader shellcode, which performs reflective PE injection so the final Agent Tesla binary never touches disk.

Before harvesting begins, the payload runs a five-stage anti-analysis gauntlet: GetModuleHandle checks for SbieDll.dll (Sandboxie), snxhk.dll (Avast sandbox hook), cmdvrt32.dll (Comodo Containment), SxIn.dll (360 Total Security), and Sf2.dll (AVG/Avast); CheckRemoteDebuggerPresent debugger detection; Thread.Sleep-based VM timing checks; WMI queries against Win32_ComputerSystem for VirtualBox/VMware manufacturer strings; and a hosting-provider lookup against the legitimate ip-api.com service to detect cloud/VPS sandboxes. The payload itself is a ConfuserEx-obfuscated .NET 4.0 binary whose assembly metadata falsely declares AssemblyProduct 'Python 3.11.3 (64-bit)' and AssemblyCompany 'Python Software Foundation' despite being a 32-bit x86 .NET executable.

Once environment checks pass, Agent Tesla v4 immediately runs 21+ credential-harvesting modules covering 27 Chromium-based browsers (including Chrome, Edge, Brave, Opera, Vivaldi, Yandex) and 13 Mozilla-based browsers (Firefox, Thunderbird, SeaMonkey, Waterfox, Pale Moon), decrypting Chrome 80+ credential stores via Local State master-key retrieval and AES-GCM decryption of v10/v11 blobs, and falling back to CryptUnprotectData for legacy Chrome. It also pulls Outlook (versions 11.0-16.0) credentials from the registry, Foxmail passwords, Thunderbird contacts, Windows Credential Manager/Vault entries, and Discord LevelDB-stored OAuth2 session tokens for account takeover. Keylogging and clipboard capture run continuously; a screen-capture module is present but was disabled in the analyzed sample. The malware also derives a hardware fingerprint from WMI-sourced motherboard serial, processor ID, and MAC address to let the operator track individual victims.

For persistence, the malware copies itself to %APPDATA%\eCXCES\eCXCES.exe and registers HKCU\Software\Microsoft\Windows\CurrentVersion\Run\eCXCES. Stolen credentials, keylogs, screenshots, and contact lists are exfiltrated within seconds of collection via .NET FtpWebRequest STOR commands to a single hardcoded FTP server, ftp.melrz.com (162.0.209.89, TCP ports 21 and 12038), authenticating with embedded credentials info@melrz.com / Newmoney2023.. File naming follows a fixed convention: PW_{user}/{host}_{datetime}.html for credentials, KL_ for keylogs, SC_ for screenshots, and Contacts_ for harvested contact lists.

## MITRE ATT&CK

- T1566.001 Phishing: Spearphishing Attachment
- T1204.002 User Execution: Malicious File
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1027.002 Obfuscated Files or Information: Software Packing
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1622 Debugger Evasion
- T1082 System Information Discovery
- T1518.001 Software Discovery: Security Software Discovery
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1555.004 Credentials from Password Stores: Windows Credential Manager
- T1552.002 Unsecured Credentials: Credentials in Registry
- T1539 Steal Web Session Cookie
- T1056.001 Input Capture: Keylogging
- T1071.002 Application Layer Protocol: File Transfer Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Agent Tesla Reflective Injection, Sandbox-Evasion Checks and eCXCES Persistence — SPL** (`TL-2026-2108-SPL-002`)

Detects the post-exploitation chain used by this campaign: the eCXCES HKCU Run-key and %APPDATA% persistence copy, and process access into the dropped wabmmxofrrdsjlsx.exe loader consistent with DonutLoader's reflective PE injection of the ConfuserEx-obfuscated Agent Tesla v4 payload, following the five-stage sandbox/AV module-presence, debugger, and VM-timing evasion gauntlet.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1547.001, T1620, T1497.001, T1622, T1518.001, T1082
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
(index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
   TargetObject="*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\eCXCES")
OR
(index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
   Image="*\\AppData\\Roaming\\eCXCES\\eCXCES.exe")
OR
(index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=10
   TargetImage="*\\wabmmxofrrdsjlsx.exe"
   (GrantedAccess="0x1010" OR GrantedAccess="0x1038" OR GrantedAccess="0x143a"))
| eval technique=case(EventCode=13,"T1547.001",EventCode=1,"T1547.001",EventCode=10,"T1620")
| table _time, Computer, User, EventCode, TargetObject, Image, TargetImage, GrantedAccess, technique
| sort -_time
```

### Microsoft KQL

```kql
DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"Software\Microsoft\Windows\CurrentVersion\Run" and RegistryValueName == "eCXCES"
| project Timestamp, DeviceName, ActionType, RegistryKey, RegistryValueData
| union (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FolderPath has @"\AppData\Roaming\eCXCES\eCXCES.exe"
    | project Timestamp, DeviceName, ActionType = "persistence_process", RegistryKey = "", RegistryValueData = FolderPath
)
| union (
    DeviceEvents
    | where Timestamp > ago(24h)
    | where ActionType == "ProcessAccess" and FileName has "wabmmxofrrdsjlsx.exe"
    | project Timestamp, DeviceName, ActionType, RegistryKey = "", RegistryValueData = InitiatingProcessFileName
)
```

### Sigma

```yaml
title: Agent Tesla eCXCES Registry Run Key Persistence
id: 8b1c3d4e-5f6a-4b7c-8d9e-0a1b2c3d4e5f
status: experimental
description: Detects the HKCU Run key 'eCXCES' registered by Agent Tesla v4 for reboot persistence, pointing to a copy in %APPDATA%\eCXCES\eCXCES.exe, following the malware's reflective in-memory injection and sandbox/debugger evasion checks.
references:
    - https://blog.knowbe4.com/anatomy-agent-tesla-bec-attack-in-memory-infostealer
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/08/22
tags:
    - attack.persistence
    - attack.t1547.001
    - attack.defense-evasion
    - attack.t1620
    - attack.t1497.001
    - attack.t1622
    - attack.discovery
    - attack.t1518.001
    - attack.t1082
    - attack.tool.agent_tesla
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Software\Microsoft\Windows\CurrentVersion\Run\eCXCES'
    condition: selection
falsepositives:
    - Coincidental use of the same Run-key value name by unrelated legitimate software (low likelihood given the random-looking value)
level: high
```

**Known false positives:**

- EDR/AV agents themselves performing ProcessAccess on newly-dropped unsigned binaries for scanning purposes
- Legitimate software installers that register HKCU Run keys with similarly random-looking value names

**Tuning notes:** Suppress ProcessAccess GrantedAccess alerts already attributed to the host's own AV/EDR process by InitiatingProcessFileName; widen the Run-key value-name match beyond the literal 'eCXCES' to any 6-8 char mixed-case folder/value once more sample builds are seen, since the malware rotates the persistence name per build.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Unicode-Emoji-Obfuscated JScript Dropper Execution from Email (Agent Tesla BEC) — KQL (locked: unlock with TL Creds)
- Agent Tesla Reflective Injection, Sandbox-Evasion Checks and eCXCES Persistence — KQL (locked: unlock with TL Creds)
- Agent Tesla FTP Exfiltration to [indicator] / [indicator] — KQL (locked: unlock with TL Creds)
- Unicode-Emoji-Obfuscated JScript Dropper Execution from Email (Agent Tesla BEC) — Sigma (locked: unlock with TL Creds)
- Agent Tesla Reflective Injection, Sandbox-Evasion Checks and eCXCES Persistence — Sigma (locked: unlock with TL Creds)
- Agent Tesla FTP Exfiltration to [indicator] / [indicator] — Sigma (locked: unlock with TL Creds)
- Unicode-Emoji-Obfuscated JScript Dropper Execution from Email (Agent Tesla BEC) — SPL (locked: unlock with TL Creds)
- Agent Tesla FTP Exfiltration to [indicator] / [indicator] — SPL (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 17)

Defanged, TLP:CLEAR.

- IP address: `162.0.209[.]89`
- Domain: `ftp[.]melrz[.]com`
- File hash: `615f9ecc51ccce0de6e88dcff70662f77965214bf5ad0cc7e07bc4fae72c40d0`

Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Hackers Hide Agent Tesla JScript Behind Unicode Emojis to Evade Detection](https://cybersecuritynews.com/hackers-hide-agent-tesla/)
- [Hackers Hide Agent Tesla Malware Behind Emojis to Steal Browser and Email Passwords](https://gbhackers.com/agent-tesla-malware/)
- [Anatomy of an Agent Tesla BEC Attack: From Inbox to In-Memory Infostealer](https://blog.knowbe4.com/anatomy-agent-tesla-bec-attack-in-memory-infostealer)
- [New Agent Tesla Malware Variant Boosts Evasion Capabilities](https://www.infosecurity-magazine.com/news/agent-tesla-malware-evasion/)
- [New Agent Tesla malware version uses emoji obfuscation to evade detection](https://www.scworld.com/brief/new-agent-tesla-malware-version-uses-emoji-obfuscation-to-evade-detection)
- [Agent Tesla v4 Uses BEC Lures and In-Memory Injection to Evade Detection](https://mallory.ai/stories/01a0243b-6af6-777f-a572-e3e0d6379526)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2108