Emmenhtal Loader inside an MP3

Summary

Trend Micro's managed detection team traced a delivery chain that opens with a counterfeit human-verification page. The visitor is told to paste an mshta command, which fetches what looks like an ordinary audio track. The track really does play music, but it also carries JavaScript wrapped first in base64 and then in hexadecimal, which Trend Micro attributes to the Emmenhtal loader. Unwrapping it starts a hidden PowerShell process that pulls down a second script disguised with a spreadsheet extension, injects code into svchost.exe and reaches a command server on port 8587. Lumma Stealer follows, together with DLL sideloading from a browser-updater executable dropped into a user profile directory, and a browser launched on a throwaway profile against a local listener. Several of the audio files were sourced from a royalty-free music library and modified.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 44 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

Both of these mechanisms appear together in 4 of the 44 campaigns on record, this one included. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

11 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.