Loading malware…
Emmenhtal is a multistage Windows malware loader and downloader active since at least 2024 and commonly used in malware-as-a-service delivery chains. It is frequently associated with financially motivated operations that distribute commodity malware including Lumma Stealer, Amadey, DanaBot, CryptBot, SmokeLoader, and other follow-on payloads, although some observed activity suggests certain affiliates have also supported politically aligned targeting. Google has referred to related final-stage activity as PEAKLIGHT, while some reporting uses the variant spelling EmmenHTAl for its HTA component.
Emmenhtal is characterized by heavily obfuscated staged execution that commonly chains HTA, JavaScript, and multiple PowerShell layers. Observed infections use techniques such as mshta-based execution, encoded script content, AES-decrypted PowerShell stages, script block smuggling, AMSI bypass attempts, and in-memory loading of .NET assemblies through PowerShell reflection. Samples have also used extreme junk-code inflation and polyglot or disguised files to hinder analysis and detection. Its role is typically to retrieve and launch additional malware rather than to perform the final objective itself.
Delivery has been observed through ClickFix or FakeCaptcha social-engineering pages, often amplified by malvertising, as well as through spearphishing and phishing chains using archives, JavaScript, LNK files, and lure documents. Public code-hosting platforms and compromised websites have also been abused to stage Emmenhtal components or downstream payloads. In one notable campaign, lure material themed around a European gas infrastructure conference was used against likely energy-sector targets, and the activity was assessed as potentially linked to a pro-Russian or Sandworm-aligned cluster. Other campaigns targeted Ukrainian entities, including a bank, and used Emmenhtal to deliver SmokeLoader or Amadey.
Emmenhtal primarily targets Windows environments and serves as an initial-access and payload-delivery component within broader criminal ecosystems. It has been observed in traffic-distribution and access-broker operations alongside other loaders and RAT delivery services, underscoring its flexibility as a reusable infection-chain building block.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Around mid-October, an infection chain leveraged lure documents related to the 21st Gas Infrastructure Europe (GIE) conference in Munich, possibly targeting organizations in the European energy sector. Threat actors distributed LNK files ... in order to deploy the Emmenhtal loader.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
The command uses ROT cipher or XOR obfuscation... powershell.exe -ep bypass -c iex ...
Talos discovered another unique file on the “Milidmdds” GitHub account during this research — a malicious Python script named “checkbalance.py”.
The malicious HTA data located in the padding of this PE file corresponds to Emmenhtal‘s first stage, which is then followed by additional consecutive Javascript and Powershell stages.
The burden of infection falls on the user for this particular step, the PowerShell command highlighted in Figure 2 is copied to the clipboard and needs to be executed in the run window by the user.
The PHP scripts themselves are highly obfuscated... The 10 MB PowerShell is highly obfuscated and usually has around 1000 unique variables, more than 20K lines of script and oddly just one function. | The function is executed using a script block smuggling technique in order to bypass AMSI.
The malicious HTA data located in the padding of this PE file corresponds to Emmenhtal‘s first stage
65 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Emmenhtal is referenced as a malware loader used to propagate Amadey.
A heavily obfuscated PowerShell loader/downloader that uses large amounts of junk math operations, embedded base64 byte arrays, XOR decoding, and .NET reflection-based execution to load and run a payload while evading static analysis and sandboxing.
A named malware used in a MaaS operation, linked in the content to threats against Ukrainian entities.
A loader used in a MaaS operation to deliver additional malicious payloads, leveraging public GitHub repositories as a distribution channel.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.