MALWARE-OTHER Win.Downloader.Emmenhtal download attempt

IPS-SWG

2 SIDs: 64745, 64776

Stats

First seen: April 2025
Last seen: September 2026

Description

Detects payload download activity associated with Win.Downloader.Emmenhtal, a Windows malware family.

Related blogs

Shared beacon code that fingerprints the visitor (browser, OS, device, country), encrypts the record with ECDH P-256 and AES-GCM, and posts it to the collect endpoint

EtherHiding in the Browser: ClickFix Chain Ends in Amatera

August 25, 202612 min read