Loading malware…
Matanbuchus is a Windows malware loader sold as Malware-as-a-Service (MaaS), written in C++, and advertised on underground forums since February 2021 by the developer BelialDemon. It is primarily used to download and execute second-stage payloads on victim systems and has been observed delivering Cobalt Strike, Qbot/QakBot, Rhadamanthys, NetSupport RAT, Remcos RAT, DanaBot, SystemBC, CastleRAT/NightShadeC2, and AstarionRAT. Reporting also links it to campaigns that can lead to ransomware deployment, data theft, fraud, or account takeover.
Earlier reporting describes Matanbuchus as a two-stage DLL-based loader. The first stage performs environment and anti-analysis checks before loading the main module. The second stage gathers host reconnaissance including domain, computer name, privilege level, process path, CPU and architecture details, RAM, DNS domain, and MAC address, then sends this data to command-and-control infrastructure as encrypted JSON. Documented anti-analysis behavior includes CIS-language checks, checking for specific paths such as %ProgramFiles%\Opera\Opera.exe, dynamic API resolution, string obfuscation, anti-debugging, and sandbox-evasion delays. Observed command support includes downloading and executing EXEs, DLLs, and MSIs, running CMD and PowerShell commands, executing payloads in memory, self-update, uninstall, and sleep.
Version 3.0, observed in the wild in July 2025 and active through at least February 2026, is described as a complete rewrite. It uses Protobuf-serialized C2 over HTTPS, ChaCha20 encryption, MurmurHash3-based API resolution, Heaven’s Gate WoW64 bypass, busy-loop evasion, hardcoded expiration logic, and dual DLL sideloading chains. It enumerates more than 70 EDR products and reports the security stack to the C2 so operators can choose execution methods. Supported payload formats include EXE, DLL, MSI, shellcode, PowerShell, CMD, and WMI. Persistence has been observed via a scheduled task named "Update Tracker Task" invoking msiexec with the uncommon -z flag.
Observed infection vectors include phishing and spear-phishing, malicious MSI installers, HTML smuggling, spam campaigns, compromised websites, ClickFix social engineering, and Microsoft Teams/Quick Assist abuse. Documented lures include OneDrive-themed scanned-document HTML attachments, fake Adobe Font Pack installers, fake browser or certificate warnings, and ClickFix prompts instructing victims to paste malicious commands into PowerShell or the Run dialog. In one 2022 campaign, an HTML-smuggled ZIP delivered an MSI signed with a revoked Westeast Tech Consulting, Corp. certificate; the MSI dropped main.dll and notify.vbs under C:\Users\username\AppData\Local\AdobeFontPack and executed the DLL via regsvr32.exe. In 2025-2026 ClickFix campaigns, msiexec was used to silently fetch remote MSI content, leading to Matanbuchus 3.0 deployment and subsequent hands-on-keyboard activity.
Technical analyses of newer chains show Matanbuchus using DLL sideloading with legitimate binaries such as Zillya! AVCore.exe and java.exe. One documented second-stage package contained java.exe, a malicious jli.dll, and an encrypted Lua script named SySUpd in a Temp directory. The malicious jli.dll unhooked kernel32.dll and ntdll.dll using clean copies from \KnownDlls, initialized an embedded Lua 5.4.7 interpreter, decrypted SySUpd with a rolling XOR key, and executed Lua that allocated RWX memory and ran encoded shellcode. Related reporting states Matanbuchus 3.0 downloaded its main module from hxxps://marle[.]io/check/updprofile.aspx, with another listed URL hxxps://mechiraz[.]com/cart/checkout/files/update_info.aspx.
Matanbuchus has been associated with multiple threat actors and clusters. It was originally linked by Mandiant to UNC4487, a suspected espionage actor observed compromising Ukrainian government-related websites and a Ukrainian auto insurance website to socially engineer targets into executing Matanbuchus or CHILLYHELL. Other reporting attributes campaigns to BelialDemon, notes use by Conti-associated activity, and describes deployment in the Fortgale-tracked "FortiSync Quasar" intrusion attributed to Mora_001. It has also been observed in TA571 and ClearFake/ClickFix-related delivery chains.
Targeting and outcomes vary by campaign. Reported targets include Ukrainian government entities, users reached through spam or compromised websites, and enterprise victims in scenarios consistent with ransomware staging, espionage, credential theft, and financial account takeover. In one December 2025 intrusion, a malicious MSI delivered Matanbuchus, followed by NetSupport RAT, Remcos RAT, and CastleRAT/NightShadeC2; the actor harvested browser credentials and attempted logins to financial-institution websites from the victim host. In February 2026 Huntress documented a ClickFix case where Matanbuchus 3.0 led to AstarionRAT and rapid lateral movement toward servers and domain controllers.
High-confidence indicators mentioned in the content include C2 or delivery infrastructure such as 193.56.146[.]60, 193.56.146[.]61, 193.56.146[.]62, 193.56.146[.]65, 172.86.123[.]222, telemetrysystemcollection.com, collectiontelemetrysystem.com, marle[.]io, mechiraz[.]com, gpa-cro[.]com, and binclloudapp[.]com; paths and artifacts such as C:\Users\username\AppData\Local\AdobeFontPack\main.dll, notify.vbs, %WINDIR%\SysWOW64\msiexec.exe -z <path>, and fake-vendor directories under %APPDATA%; and hashes including b9b399dbb5d901c16d97b7c30cc182736cd83a7c53313194a1798d61f9c7501e (second-stage sample), 8833f28dc0cadd4b3c5676981b2a76e1c0683f2e2b8e3dac8270622c12e032ef (2022 DLL), and 5dcbffef867b44bbb828cfb4a21c9fb1fa3404b4d8b6f4e8118c62addbf859da (2022 MSI).
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
If the “Auto-fix” button was clicked, the search-ms protocol displayed a similar WebDAV-hosted “fix.msi” or “fix.vbs” in Windows Explorer... This led to the installation of Matanbuchus.
Matanbuchus, offered as part of malware-as-a-service, has been available on underground forums for a rental price of $2500 since February 2021. Recently, the CYFIRMA research team observed this malware reappear through spam campaigns.
According to threat intelligence shared by Google Mandiant, UNC4487 is a suspected espionage actor that has been observed compromising the websites of Ukrainian government entities to redirect and socially engineer targets to execute Matanbuchus or CHILLYHELL malware.
The campaign, internally dubbed "FortiSync Quasar," revealed an evolution from ransomware operations to strategic espionage, deploying Matanbuchus 3.0, Astarion RAT, and SystemBC.
“uses ClickFix techniques to deliver CastleLoader and Matanbuchus”
35 distinct techniques documented for this family, organized by ATT&CK tactic.
UNC4487 is a suspected espionage actor that has been observed compromising the websites of Ukrainian government entities to redirect and socially engineer targets to execute Matanbuchus or CHILLYHELL malware.
TA571 email lure. In this campaign, emails contained an HTML attachment that displayed a page resembling Microsoft Word.
The initial loader creates a working folder, where it downloads and saves the first-stage binary to use it as persistence to be run by the scheduled task... The loader doesn’t delete the scheduled task that can indicate infection by Matanbuchus.
Researchers observed an increasingly popular technique leveraging unique social engineering to run PowerShell and install malware.
The loader can also act like a bot and run CMD commands... creates an instance of cmd.exe with the extracted command line, e.g., C:\\Windows\\System32\\cmd.exe /c <cmd_from_c2>.
This malware sample was written in a combination of Html and JavaScript language... the Threat actor embedded the malicious zip file in the JavaScript in base64 format.
The executed routine will be one of the exported functions of the DLL... each command will load the DLL to memory and run another exported function of the downloaded payload, DllRegisterServer or DllInstall.
The malicious content is contained in the HTML/website in various places, and encoded in several ways, such as double-Base64, reverse Base64 or even clear text in various elements and functions.
This command ran the DllUnregisterServer function of the DLL, which dropped and executed another DLL
the MSI ran a bundled DLL, “Inkpad3.dll”, with the LOLBAS command “msiexec -z”.
This MSI file loads this malicious dll file[ main.dll] through regsvr32.exe with arguments being -n -i “install”.
The loader executes DLLs by using the classic binary, Rundll32.exe... uses CreateProcessA to run rundll32.exe, which will run the final payload.
If this path exists, the malware will exit, which might be quite an odd check. We assume that this check tends to be an anti-sandbox trick for known and popular online sandbox services like Any.Run.
This dll having anti-debugging capabilty ,this dll file is checking presences for any debugger by calling APIs such as IsProcessorFeaturePresent(),IsDebuggerPresent(), QueryPerformanceCounter().
The last part of the victim’s reconnaissance is to get the computer’s MAC address... calling... GetAdaptersInfo... holds the MAC address... The loader gets the name of the DNS domain of the local machine... reads the victim logon server’s name.
The loader first retrieves the network domain name associated with the victim user by calling ExpandEnvironmentStringsA with the environment variable of %USERDOMAIN%.
Matanbuchus uses a known technique to check whether the running process is running with administrator privileges... calls CheckTokenMembership with the created SID of the administrator group.
The loader gathers information about the compromised machine to send to the C2 server... retrieves the network domain name... computer name... checks the privileges... gets the full path of the process... collects basic CPU information... checks if the machine architecture is 32-bit or 64-bit... gets the number of processors... reads the victim logon server’s name... gets the RAM size... gets the name of the DNS domain of the local machine.
If this path exists, the malware will exit, which might be quite an odd check. We assume that this check tends to be an anti-sandbox trick for known and popular online sandbox services like Any.Run.
This dll having anti-debugging capabilty ,this dll file is checking presences for any debugger by calling APIs such as IsProcessorFeaturePresent(),IsDebuggerPresent(), QueryPerformanceCounter().
The data sent to the C2 server is a base64 string of JSON data... JSON values are encrypted and then encoded with base64... The value for each key is encrypted with RC4 encryption and later encoded with base64.
C2: 216.126.237[.]122:443 Confirmed via JA3 TLS fingerprinting and malware config extraction
This malicious dll file is establishing a connection to the C&C server for download and trying to download another malware which is Cobalt Strike beacon payload.
downloading a remote PowerShell script and execute it in-memory. The second PowerShell script was essentially used to download yet another PowerShell script.
The Threat actor embedded the malicious zip file in the JavaScript in base64 format... Threat actors use a customized decryption method to decrypt the malicious code... using a combination of two key pairs to generate one XOR key for decrypting the encrypted contents.
186 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A premium C++ malware loader sold as MaaS that performs adaptive payload delivery by enumerating installed EDR products, reporting them to C2, and allowing operators to choose execution methods accordingly. It supports multiple payload formats, uses Protobuf-over-HTTPS with ChaCha20 encryption, employs Heaven's Gate and DLL sideloading for evasion, and has delivered RATs, stealers, Cobalt Strike, and unspecified ransomware.
A malware-as-a-service loader referenced as used in a prior ClickFix case.
Loader used in a related ClickFix campaign to deliver MIMICRAT.
Malware-as-a-service loader delivered via ClickFix campaigns; used as a foothold to rapidly progress to lateral movement and domain controller access, with the stated objective to deploy ransomware or exfiltrate data.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.