EmmenhtalMalware
- idatdropper
- peaklight
Emmenhtal is a malicious loader likely distributed since early 2024, and publicly detailed by Orange Cyberdefense CERT in August 2024. Emmenhtal is an obfuscated multistage payload that spawns an execution of the LOLBIN mshta.exe to read a first HTA stage that embeds a malicious JavaScript code. Once interpreted and executed, the JavaScript decodes and runs a PowerShell script.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io3 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1684Social Engineering
“By May 20241, ClecarFake adopted the new social engineering tactic ClickFix, displaying fake error messages in the web browser and deceiving users into copying and executing a given malicious PowerShell code that finally infected their systems.”
- T1036Masquerading
“Of note, this PowerShell script is masquerading as a legitimate installer for “SecureModule Engine v1.0.0” , with installation messages and a progress bar.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Meet IClickFix: a widespread framework using the ClickFix tactic“We observed it distributing Emmenhtal Loader, which ultimately downloaded XFiles Stealer.”
-
ClearFake's Variant: Web3 Exploitation for Malware Delivery“The chain leads to Emmenhtal Loader dropping Lumma Stealer, with Vidar Stealer also observed in January 2025.”
-
WebDAV-as-a-Service: The Infrastructure Behind Emmenhtal“WebDAV-as-a-Service: The Infrastructure Behind Emmenhtal”
Indicators in its reports
named in the reports above- ahpc.gov[.]ghin 1 report
- hxxps://ototaikfffkf[.]com/fffa.jsin 1 report
- ototaikfffkf[.]comin 1 report
- hxxps://ksfldfklskdmbxcvb[.]com/gigi?ts=1765169670in 1 report
- ksfldfklskdmbxcvb[.]comin 1 report
- hxxps://ksdkgsdkgkgmgm[.]pro/ofofo.jsin 1 report
- ksdkgsdkgkgmgm[.]proin 1 report
- hxxps://ksfldfklskdmbxcvb[.]com/-in 1 report
- hxxps://booksbypatriciaschultz[.]com/liner.phpin 1 report
- booksbypatriciaschultz[.]comin 1 report
- hxxps://scottvmorton[.]com/tytuy.jsonin 1 report
- scottvmorton[.]comin 1 report
- 05b03a25e10535c5…1def6f072c6din 1 report
- pusykakimao[.]comin 1 report
- fnotusykakimao[.]comin 1 report
- hxxp://qq525f.short[.]gy/claudin 1 report
- qq525f.short[.]gyin 1 report
- short[.]gyin 1 report
- hxxps://bestieslos[.]com/over.jsin 1 report
- bestieslos[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.