Anatomy of an Agent Tesla BEC Attack: From Inbox to In-Memory Infostealer

Lead Analysts: Prabhakaran Ravichandhiran and Jeewan Singh Jalal

EXECUTIVE SUMMARY

Phishing is a form of social engineering that has evolved beyond simple lures into complex, multi-stage attacks exploiting trusted software, cloud identities and business platforms to bypass traditional security.

Attackers leverage these campaigns to deliver trojans capable of stealing credentials and also establishing remote code execution, which might serve as a gateway for lateral movement. This evolution enables them to maintain persistent access, making it harder for conventional email defenses to detect and mitigate these high-impact threats.

Over the past decade, adversaries running Agent Tesla malware have methodically bypassed defenses by transitioning from macro-heavy documents to script-based droppers and fileless, in-memory injection. These reflective techniques circumvent traditional signature matching, maintaining the efficacy of this pervasive crimeware against unhardened environments.

Agent Tesla remains a focal point of this technical evolution, operating as a pervasive and actively maintained strain of crimeware. The operational maturity demonstrated in its delivery infrastructure, staging mechanics and anti-analysis gates ensures continued efficacy against target environments that lack hardened defenses against fileless execution patterns.

A Business Email Compromise (BEC) campaign targeting finance departments is delivering.

Agent Tesla v4, the fourth primary iteration of the Agent Tesla malware, operates via a JScript dropper that uses an unusual obfuscation technique: Unicode emoji characters embedded throughout the code body. The delivery chain runs JScript → DonutLoader shellcode → reflective in-memory MSIL injection, ensuring the terminal payload never touches disk. The final payload is a ConfuserEx-obfuscated .NET infostealer configured to sweep credentials from more than 40 applications and exfiltrate via FTP to a single threat-actor-controlled domain.

This analysis covers the full chain: email lure, dropper mechanics, extracted MSIL binary analysis and each credential-harvesting module, using decompiled C♯ source as the primary reference.

Key Findings from the Agent Tesla v4 BEC Campaign Analysis

• A BEC lure spoofing Metropolitan Bank and Trust Company delivers a 6.94 MB JScript dropper (SWIFT Payment Maker 103 - 10.06.26.JS) disguised as a forwarded wire-transfer thread.
  
  
• The dropper hides its logic behind Unicode emoji characters interleaved through the code body, an obfuscation layer that defeats string-based signature matching and casual review, with no eval-of-base64-and-execute step and no second-stage download.
  
  
• The execution chain runs JScript → DonutLoader shellcode → reflective in-memory MSIL injection. The final Agent Tesla binary never touches the disk.
  
  
• The extracted payload is a ConfuserEx-obfuscated .NET 4.0 binary masquerading as "Python 3.11.3 (64-bit)" in its assembly metadata, a claim directly contradicted by its actual 32-bit x86/.NET 4.0 architecture.
  
  
• Before harvesting begins, the malware runs a five-part anti-analysis gauntlet: a debugger check, a live cloud/hosting IP lookup, a VM timing attack, sandbox DLL enumeration and WMI-based VM detection.
  
  
• 21 credential-harvesting modules target 27 Chromium and 13 Mozilla browsers, plus Outlook, Foxmail, Discord, Thunderbird contacts and Windows Credential Manager.
  
  
• All stolen data (credentials, keylogs, screenshots, contacts) exfiltrates via FTP to a single domain, ftp[.]melrz[.]com, and the FTP credentials are plaintext and extractable directly from the binary.

Email Breakdown: Deconstructing the Lure

The email arrives as a forwarded thread presenting as internal correspondence forwarded to an account’s contact. The sender address spoofs Metropolitan Bank and Trust Company, a legitimate Philippines-based commercial bank. The message body reads like routine banking operations: the sender identifies as a Relationship Associate and references pending wire transactions by company name and dollar amount.

The thread is structured to look like an in-progress discussion the recipient has been brought into late. It directly instructs the target to confirm the attached document and reply. Social pressure is time-scarcity ("KINDLY CONFIRM BELOW ATTACHED AND GET BACK TO US ASAP") backed by authority borrowed from a named, real institution.

Using Emojis to Hide the Malware

The .JS extension hands execution directly to Windows Script Host (cscript.exe) on double-click, requiring no additional user prompt beyond the initial open-with dialog. The file size of the script file (6.9 MB) raises a suspicion of being heavily obfuscated, holding encoded strings/binaries inside them.

Opening the file confirms it: the script body is saturated with Unicode emoji characters (hearts, water droplets and similar symbols) interleaved directly through the code.

The actual logic runs underneath these characters; Windows Script Host's JScript interpreter ignores them at parse time. The emoji characters are the entire obfuscation layer, disrupting string-based signature matching and making the code visually noisy enough to defeat casual review.

Drop Sequence

The script writes two files to C:\Users\Public\Libraries\:

• wabmmxofrrdsjlsx.exe — 32-bit .NET loader binary
• wabmmxofrrdsjlsx.ttf — not a font; encoded Agent Tesla payload blob read by the loader at runtime

The .ttf extension is misdirection. The loader reads it as raw bytes and passes it into DonutLoader shellcode for reflective portable executable (PE) injection. The final Agent Tesla binary never touches the filesystem. By the time credential harvesting begins, there is no PE on disk for a file-based scanner to flag.

Static Analysis of Agent Tesla V4

The malware is intentionally scrambled using an obfuscator tool called "ConfuserEx" to make it nearly unreadable for anyone trying to analyze it. It hides its logic in two primary ways:

Randomization: It renames every component of the code (such as function and class names) into meaningless, randomized identifiers.

Logic Obfuscation: It transforms the program's normal structure into a complex, repetitive series of loops and variables that a computer can run, but a human analyst would find extremely difficult to follow.

The following observations highlight several critical technical takeaways identified during the static analysis.

Identity Deception

The assembly presents itself as a Python installer in its embedded metadata:

AssemblyProduct: "Python 3.11.3 (64-bit)"
 
AssemblyCompany: "Python Software Foundation"

AssemblyTitle: "setup" 

AssemblyDescription: "Python 3.11.3 (64-bit)"

The actual assembly GUID is f45b853c-c9d3-495e-9acb-d41a4a90029f. An analyst relying on description strings in process lists or memory dumps will see a Python installer. The 32-bit x86 architecture targeting .NET 4.0 is an immediate contradiction against any real Python 3.11 64-bit installer.

Anti-Analysis Gauntlet

The orchestrator runs the detection routine early. If any check returns true, the process calls Application.Exit() with no payload delivery. This module runs a pre-checkup of the system environment before the execution to confirm there are no traces of being debugged or monitored.

Debugger check: The malware uses a standard Windows function (CheckRemoteDebuggerPresent) as its first line of defense to detect if it is being watched by a debugger. If it finds one, it stops running to avoid being analyzed.

Cloud/hosting IP check: The malware checks if it is running on a cloud-based server. If it detects a hosting provider IP, it immediately shuts down to avoid being analyzed by security software.

Timing attack: The malware pauses briefly and checks the system clock to see if it moved as expected. If the clock runs faster than normal(Accelerated VirtualMachine clocks return values well below 10 ticks for a real 10 milliseconds sleep). This makes the malware detect that it is being analyzed in a lab/protected environment and stops further execution to avoid detection.

Sandbox DLL enumeration: Calls GetModuleHandle for five DLL names:

• SbieDll.dll — Sandboxie
• snxhk.dll — Avast sandbox hook
• cmdvrt32.dll — Comodo
• SxIn.dll — 360 Total Security
• Sf2.dll — AVG and Avast

WMI VM detection: Queries Win32_ComputerSystem for manufacturer/model strings: "microsoft corporation" with "VIRTUAL" in the model, "vmware" in the manufacturer, or model equal to "VirtualBox."

Configuration

This is the configuration module for the malware that holds all the config data for execution as well as exfiltration. Hardcoded C2 credentials are embedded directly in the binary's static constructor. The keylogger, screen capture, Tor Panel and clipboard logger are all disabled in this build's static configuration. The infrastructure for all three is fully present and wired up; the flags could be flipped in a different build or overridden at runtime.

Hardware Fingerprinting

Before harvesting, the malware creates a persistent hardware fingerprint. Using WMI queries it collects the motherboard serial number, CPU processor ID and primary MAC address, then hashes them via MD5 into a unique hardware ID. This identifier is included in all exfiltration headers, allowing the operator to track victims consistently across OS reinstalls or IP rotations.

How Does Agent Tesla Harvest Credentials?

Agent Tesla utilizes a suite of dedicated, internal decryption routines tailored for each specific target application. This allows the infostealer to methodically harvest credentials from otherwise protected data stores.

The analysis below provides a technical decomposition of the malware's operational mechanics as it sweeps data from various web browsers, messaging platforms and native Windows credential repositories.

Browser Passwords

• 27 Chromium-based browsers: Chrome, Edge, Brave, Opera, Vivaldi, Yandex and 21 others.
• 13 Mozilla-based browsers: Firefox, Thunderbird, SeaMonkey, Waterfox, PaleMoon, IceDragon and others.

Chrome 80+ (v10/v11 prefix)

This is the browser credential decryption found inside the Agent Tesla malware.

• Read Local State JSON from the browser profile directory.
• Extract encrypted master key, base64-decode, strip 5-byte DPAPI header.
• Pass to CryptUnprotectData to recover the AES master key.
• Extract 12-byte IV from bytes 3–14 of the encrypted blob.
• Decrypt with AES-GCM and verify the 16-byte auth tag.

Older Chrome (no v10/v11 prefix): Direct call to CryptUnprotectData.

Locked File Handling

Standard SQLite queries cannot directly access a browser's Login Data database if it is currently locked by an active process. To circumvent this limitation, the application copies the locked file to a temporary directory for safe retrieval. Rather than depending on external libraries, it utilizes a custom, built-in SQLite B-tree parser. The program validates the "SQLite format 3" header, extracts the page size and encoding configurations, navigates through the master table, and reads the cell records directly from the raw data.

For truly locked handles where even FileShare.ReadWrite fails, the malware escalates:

• Calls NtQuerySystemInformation(SystemHandleInformation) to enumerate all system handles.
• Finds handles belonging to the process holding the target file.
• Duplicates the handle into its own process via DuplicateHandle.
• Maps a view via CreateFileMapping / MapViewOfFile and reads raw bytes via Marshal.Copy.

Chrome's file locking is not an obstacle.

Outlook

The malware opens seven registry keys targeting Office versions 11.0, 12.0, 14.0, 15.0, 16.0 and two legacy paths to extract IMAP/POP3/HTTP/SMTP passwords and then decrypts via DPAPI.

• Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles
• Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676

Foxmail

Reads from two registry paths:

HKEY_CURRENT_USER\Software\Aerofox\FoxmailPreview

HKEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1\FoxmailPath

Passwords are decrypted via a custom XOR algorithm, not DPAPI.

Discord Token Theft

Scans three LevelDB directories:

%APPDATA%\Discord\Local Storage\leveldb
%APPDATA%\discordcanary\Local Storage\leveldb
%APPDATA%\discordptb\Local Storage\leveldb

Extracts OAuth2 tokens via two regex patterns:

[\w-]{24}\.[\w-]{6}\.[\w-]{27}   (standard user token)

mfa\.[\w-]{84}        (MFA token)

A Discord OAuth2 token gives a logged-in session of the user's account itself; whoever holds it can read messages, access servers and impersonate the victim without needing a password.

For the attacker this has several uses:

• Account takeover — use the victim's Discord account directly
• Pivot to contacts — message the victim's friends/colleagues with phishing links, leveraging existing trust
• Sell the token — Discord accounts with aged history and server memberships have market value on crimeware forums
• MFA bypass — the mfa.* token pattern the malware specifically targets grants access even on accounts with two-factor enabled, since the token already represents a post-MFA session

Thunderbird Contacts

Reads global-messages-db.sqlite, queries the identities table, extracts email address values and uploads as .txt files. Uses the same hand-written SQLite parser.

Windows Credential Manager

Four functions are imported directly from vaultcli.dll:

VaultOpenVault
VaultEnumerateVaults
VaultEnumerateItems
VaultGetItem_WIN8

Credential values are read by dereferencing raw vault structures via Marshal.PtrToStructure, Marshal.ReadInt32 and Marshal.PtrToStringUni. Additional grabbers target IncrediMail, The Bat!, DynDNS, Windows Vault and SMTP credential stores. The full registered list covers 21 modules.

How Agent Tesla Uses the Keylogger and Clipboard Tool

Both the keylogger and clipboard modules are not active in this Agent Tesla build, but the implementation is complete and functional.

Keyboard Hook

• Installs a system-wide low-level keyboard hook via SetWindowsHookEx with hook ID 13 (WH_KEYBOARD_LL), intercepting all keystrokes globally before they reach any window.
  
  
• The callback handles WM_KEYDOWN, WM_KEYUP, WM_SYSKEYDOWN, and WM_SYSKEYUP.
  
  
• Resolves virtual key codes to Unicode characters via ToUnicodeEx() with the current keyboard layout, tracks active window titles via GetForegroundWindow() / GetWindowText().
  
  
• Formats special keys as tokens ({BACK}, {TAB}, {ENTER}, {CAPSLOCK}, {ALT+F4}, {Win}, {F1}–{F12}) and writes output as HTML with window title changes wrapped in tagged timestamps.
  
  
• Keylog data is flushed every 20 minutes and uploaded to FTP as KL_{username}/{computername}_{datetime}.html.

Clipboard Capture

Registers as a clipboard viewer via SetClipboardViewer. Fires on WM_DRAWCLIPBOARD (message 776). On each clipboard change, reads clipboard text, HTML-encodes it and appends to the keylog buffer:

<hr> Copied Text: <br>{text}<hr>

This captures passwords copied from password managers before they are auto-filled or typed.

How Does Agent Tesla Exfiltrate Credentials?

All data is exfiltrated to ftp[.]melrz[.]com (resolving to 162[.]0[.]209[.]89) via FtpWebRequest with the STOR command. Credentials are read directly from the static configuration at runtime.

FTP File Naming Convention

Each file includes a system fingerprint header: timestamp, username, computer name, OS name, CPU, RAM, public IP and the MD5 hardware ID. A secondary TCP connection is made on port 12038 against the same C2 IP, consistent with Agent Tesla's configurable non-standard port behavior.

Evasion and Persistent Mechanisms

• TLS Certificate Bypass: Disables validation for all outgoing connections, ensuring the malware maintains unhindered communication with C2 infrastructure without triggering security alerts or errors.
  
  
• Mark of the Web Removal: Strips the "Zone.Identifier" NTFS data stream to neutralize Windows SmartScreen and security origin checks, making the malicious file appear as trusted local content.
  
  
• Hosts File Manipulation: Prepares the system for traffic redirection, potentially blocking antivirus update services to isolate the host from security patches and neutralize remediation efforts.
  
  
• Dormant Persistence: Ensures long-term infection by copying the binary to %APPDATA% and registering a startup key, allowing the malware to survive system reboots.
  
  
• Single-Instance Enforcement: Prevents duplicate processes to minimize system noise and resource contention, which helps the malware avoid detection and prevents errors during credential harvesting.
  
  
• Activity-Aware Screen Capture: Extends intelligence gathering beyond credentials by capturing visual user data, providing operators with a complete view of sensitive, non-textual interactions.

What Are the Agent Tesla Indicators of Compromise?

Our technical analysis of this Agent Tesla v4 operation yielded the following actionable indicators of compromise (IOCs). Defenders can use these forensic artifacts to investigate potential breaches or implement proactive blocks across their defensive perimeters.

Lure

Dropped Files

Network / C2

Assembly Metadata (Payload)

Sandbox Evasion DLL Checks

snxhk.dll, cmdvrt32.dll, SbieDll.dll, SxIn.dll, Sf2.dll

Persistence (if Activated)

What Defenders Need to Know

The FTP credentials in this binary are plaintext and extractable without running the sample. Any host that has connected to ftp[.]melrz[.]com on ports 21 or 12038 should be treated as compromised. The credential dump lands on the attacker's FTP server within seconds of execution; there is no delayed staging.

The emoji-obfuscation approach in the JS dropper does not survive any YARA rule that looks for the Unicode code points used (U+2764, U+1F4A7, etc.) alongside JScript-specific patterns. A rule matching both the emoji distribution pattern and WScript.Shell or CreateObject calls will catch this family.

The assembly metadata masquerade ("Python 3.11.3 (64-bit)") means this binary can appear legitimate in process lists and memory dumps when relying on description strings. The x86 architecture targeting .NET 4.0 from a file claiming to be a Python 3.11 64-bit installer is an immediate contradiction and trivial to flag.

Machine cleanup requires rotating every credential accessible from the compromised host: browser passwords, stored email credentials, Windows Vault entries and any Discord accounts active on the machine. The credential sweep runs in full on first execution; there is no second chance.

Mitre Attack Mapping

How KnowBe4 Keeps You Ahead: Stopping the Fileless Threat Post-Delivery

When an attack chain utilizes a fileless injection pattern like masking a JScript dropper with Unicode emojis to run a payload injected entirely in memory, traditional file-based endpoint scanners frequently miss it. Because the final Agent Tesla binary never touches the disk, defense must focus on intelligent inbound mailflow analysis, automated remediation and human security culture.

KnowBe4’s integrated ecosystem stops this campaign directly at multiple intercept points:

1. KnowBe4 Inbound Email security: Real-Time Behavioral AI

This Agent Tesla lure relies on a sophisticated "forwarded thread" deception to trick finance departments into opening a raw script file.

• The Intercept: KnowBe4 Defend goes beyond simple file matching by utilizing behavioral AI and Natural Language Processing (NLP) to detect abnormalities in inbound mailflow patterns.
  
  
• The Result: It automatically injects real-time, context-aware interactive warning banners onto suspicious emails, breaking the attacker's illusion of legitimacy before the employee double-clicks the attachment.

2. PhishER Plus: Automated Global Eradication

Because Agent Tesla exfiltrates credential stores over FTP within seconds of execution, rapid containment is mandatory.

• The Intercept: If an alert user detects the suspicious .JS file extension and reports it via the Phish Alert Button (PAB), the email is instantly analyzed by Knowbe4 Threat Lab.
  
  
• Flipping the Script with Crowdsourced Intel: KnowBe4 pulls global, real-time data from millions of users worldwide. If a brand-new phishing kit hits another company first, KnowBe4's global threat feed flags the indicators, allowing our system to recognize and block the kit before it ever reaches other employees' inboxes.