Loading malware…
Matanbuchus is a Windows malware-as-a-service loader first publicly identified in 2021 and marketed on Russian-speaking cybercrime forums. It is commonly described as a commercial two-stage loader used to retrieve and execute follow-on payloads on compromised systems, including QakBot and Cobalt Strike, and has also been associated with broader cybercrime delivery ecosystems. The service has been linked to the actor known as BelialDemon.
Matanbuchus is designed for stealthy payload delivery and post-compromise tasking. Reported capabilities include downloading and launching additional malware, executing DLLs and executables, running arbitrary shell and PowerShell commands, loading shellcode, and manually mapping payloads directly into memory. Multiple analyses describe obfuscated string handling, dynamic API resolution using FNV-1a hashing, anti-analysis and anti-sandbox checks, and encrypted command-and-control communications using base64-encoded JSON with RC4-encrypted values. Some variants establish persistence through scheduled tasks that repeatedly invoke trusted Windows utilities to execute the loader or updated components.
Observed infection chains show Matanbuchus delivered through phishing and malspam, often using ZIP archives, HTML smuggling, and malicious MSI installers masquerading as legitimate software or updates. It has also been observed in ClickFix-style social-engineering chains in which victims are tricked into executing malicious commands that lead to MSI or script-based installation. MSI-based deployments commonly use asynchronous custom actions, fake error dialogs, and trusted Windows binaries such as regsvr32 to launch the loader while misleading the user.
Matanbuchus has been used as an access-enabling component in multi-stage intrusions and criminal operations. It has appeared in campaigns that culminated in Cobalt Strike deployment, and later-stage activity has included delivery of remote-access tools and other malware families. Reporting also places it within ecosystems that use crypters and loaders to evade detection and broker access between initial infection and downstream monetization. The malware primarily targets Windows environments and has been observed against organizations in sectors including education and technology, while also appearing in broad spam-driven campaigns without narrow sector specialization.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Beginning in May 2024, and carrying into early June, eSentire has identified an increase in observations of Matanbuchus malware. Matanbuchus is a loader type malware that was first identified in 2021.
If the “Auto-fix” button was clicked, the search-ms protocol displayed a similar WebDAV-hosted “fix.msi” or “fix.vbs” in Windows Explorer... This led to the installation of Matanbuchus.
According to threat intelligence shared by Google Mandiant, UNC4487 is a suspected espionage actor that has been observed compromising the websites of Ukrainian government entities to redirect and socially engineer targets to execute Matanbuchus or CHILLYHELL malware.
The campaign, internally dubbed "FortiSync Quasar," revealed an evolution from ransomware operations to strategic espionage, deploying Matanbuchus 3.0, Astarion RAT, and SystemBC.
“uses ClickFix techniques to deliver CastleLoader and Matanbuchus”
29 distinct techniques documented for this family, organized by ATT&CK tactic.
To establish persistence, the malware creates a scheduled task to run the 8c01.nls file with a specific function by using the following command line.
"C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /MO 3 /TN %PROCESSOR_REVISION% /TR "%windir%\system32\regsvr32.exe -e %local_ocx_path%"
Avoid extracting malicious ZIP archives, and executing LNK files, or script files without conducting thorough analysis
Except for the 1st entry (“Vs”), which is used as a no-op command, the others are rather descriptive... Run PS in memory
Upon extracting and executing the JavaScript file from the ZIP archive, the script downloads and executes a Windows Installer package (MSI) which is used to deploy the Matanbuchus DLL payload.
crypters, which are also referred to as loaders or packers, are applications designed to encrypt and obfuscate malware to evade detection by antivirus (AV) scanners and hinder analysis.
In the latest version of MATANBUCHUS, the malware dynamically resolves its API to avoid exposing its functionality through its import table.
Ensure the "Show file extensions" option is enabled on your system to reveal the actual file extensions Icon masquerading is a common tactics employed by threat actors to disguise malicious files
The next obfuscation that MATANBUCHUS uses is string encryption... The DWORD64 number is used as the XOR value to decode the string.
the script downloads and executes a Windows Installer package (MSI) which is used to deploy the Matanbuchus DLL payload.
launching it through Regsvr32.exe ... this task will execute the regsvr32.exe command to register the downloaded DLL
Before downloading the DLL file, it calls APIs such as IsProcessorFeaturePresent(), GetSystemTimeAsFileTime(), IsDebuggerPresent(), QueryPerformanceCounter() and cpuid to ensure that the malware is not running under a controlled environment such as VMware, Sandbox, etc.
Both functions share an anti-sandbox check by checking for the number of processes running on the system... checks if it is less than 50.
This gives the TA victim details such as MAC address, computer name, etc.
Before downloading the DLL file, it calls APIs such as IsProcessorFeaturePresent(), GetSystemTimeAsFileTime(), IsDebuggerPresent(), QueryPerformanceCounter() and cpuid to ensure that the malware is not running under a controlled environment such as VMware, Sandbox, etc.
318 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
52 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A premium C++ malware loader sold as MaaS that performs adaptive payload delivery by enumerating installed EDR products, reporting them to C2, and allowing operators to choose execution methods accordingly. It supports multiple payload formats, uses Protobuf-over-HTTPS with ChaCha20 encryption, employs Heaven's Gate and DLL sideloading for evasion, and has delivered RATs, stealers, Cobalt Strike, and unspecified ransomware.
A malware-as-a-service loader referenced as used in a prior ClickFix case.
Loader used in a related ClickFix campaign to deliver MIMICRAT.
Malware-as-a-service loader delivered via ClickFix campaigns; used as a foothold to rapidly progress to lateral movement and domain controller access, with the stated objective to deploy ransomware or exfiltrate data.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.