Loading malware…
Matanbuchus is a Windows malware loader written in C++ and commercialized as malware-as-a-service by the developer BelialDemon. Advertised on Russian-speaking cybercrime forums since February 2021, it downloads and executes additional malware, including Qakbot, Cobalt Strike, Rhadamanthys, and NetSupport RAT. Observed targets have included a Belgian technology company and American educational institutions.
Matanbuchus historically uses an obfuscated two-stage architecture comprising an initial loader and a core component responsible for command-and-control communication and payload execution. It supports executable and DLL payloads, shellcode, and arbitrary PowerShell and command-shell commands. Components can be manually mapped and executed within the existing process without writing the downloaded payload to disk. The malware collects host information, including hardware characteristics, domain membership, privilege level, and system identifiers, and establishes persistence through scheduled tasks. Its defenses include encrypted strings, hashed API resolution, anti-debugging checks, and timing- and process-based sandbox detection. Earlier variants exchange Base64-encoded JSON with RC4-encrypted values over HTTP.
Delivery campaigns have used phishing, spearphishing, and malicious spam carrying archives and HTML attachments. HTML smuggling produces additional archives containing malicious Windows Installer packages, which may impersonate legitimate software installers and display fake installation errors while executing the loader. Other campaigns use malicious spreadsheet documents, ClickFix lures, or Microsoft Teams helpdesk impersonation and vishing followed by Quick Assist abuse.
Matanbuchus 3.0, introduced in July 2025 as a substantial rewrite, uses Protobuf-serialized command-and-control over HTTPS with ChaCha20 encryption. It inventories endpoint security products, uses Heaven’s Gate transitions to bypass WoW64 user-mode hooks, and employs staged DLL sideloading and reflective payload loading. Campaigns documented through February 2026 delivered AstarionRAT. Credential theft, proxying, and lateral movement performed by downstream payloads or operators are distinct from the loader’s own functionality.
6 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
This dll file belongs to the Matanbuchus malware family, and it is trying to download additional payloads through C&C servers.
If the “Auto-fix” button was clicked, the search-ms protocol displayed a similar WebDAV-hosted “fix.msi” or “fix.vbs” in Windows Explorer... This led to the installation of Matanbuchus.
According to threat intelligence shared by Google Mandiant, UNC4487 is a suspected espionage actor that has been observed compromising the websites of Ukrainian government entities to redirect and socially engineer targets to execute Matanbuchus or CHILLYHELL malware.
The campaign, internally dubbed "FortiSync Quasar," revealed an evolution from ransomware operations to strategic espionage, deploying Matanbuchus 3.0, Astarion RAT, and SystemBC.
“uses ClickFix techniques to deliver CastleLoader and Matanbuchus”
34 distinct techniques documented for this family, organized by ATT&CK tactic.
In recent cases observed by eSentire, malicious web-browser advertisements (Malvertising) were used to direct users to threat actor controlled web pages.
malicious Google ads directed users to an attacker-controlled page... Users are then directed to download a ZIP file
The Matanbuchus infection starts through spam emails containing a ZIP attachment.
It has been observed that the loader spreads through social engineering in the form of malicious Excel documents.
Attacker calls via Teams impersonating IT helpdesk, convinces user to open Quick Assist, then instructs them to execute a script that downloads the loader MSI.
To establish persistence, the malware creates a scheduled task to run the 8c01.nls file with a specific function by using the following command line.
Creates scheduled task Update Tracker Task via %WINDIR%\SysWOW64\msiexec.exe -z %Matanbuchus_path%.
Avoid extracting malicious ZIP archives, and executing LNK files, or script files without conducting thorough analysis
The Threat actor embedded the malicious zip file in the JavaScript in base64 format.
Next, the malware manually resolves the addresses of imported APIs in the PE’s import table... calls GetProcAddress to retrieve its address from the loaded library
Upon executing the HTML file, it decodes the base64 content embedded in the file and drops a ZIP file in the Downloads folder.
Upon clicking the Html attachment, it drops a zip archive file and this zip file contains an MSI file. On executing the MSI file, it shows the fake Adobe error message.
To establish persistence, the malware creates a scheduled task to run the 8c01.nls file with a specific function by using the following command line.
Creates scheduled task Update Tracker Task via %WINDIR%\SysWOW64\msiexec.exe -z %Matanbuchus_path%.
Created rogue domain accounts; command shown: net user <rogue_account> <password> /add /domain.
To establish persistence, the malware creates a scheduled task to run the 8c01.nls file with a specific function by using the following command line.
Creates scheduled task Update Tracker Task via %WINDIR%\SysWOW64\msiexec.exe -z %Matanbuchus_path%.
crypters, which are also referred to as loaders or packers, are applications designed to encrypt and obfuscate malware to evade detection by antivirus (AV) scanners and hinder analysis.
Anti-analysis includes MurmurHash3 API resolution.
Installed under fake vendor names and used C:\ProgramData\USOShared\, which mimics a Windows Update staging directory.
Matanbuchus brute-forces ChaCha20 decryption of the INFO file and decrypts the downloaded main module in 8KB ChaCha20 chunks.
T1218.007: System Binary Proxy Execution: Msiexec
launching it through Regsvr32.exe ... this task will execute the regsvr32.exe command to register the downloaded DLL
Anti-analysis includes Heaven's Gate, busy-loop sandbox evasion, and a hardcoded expiration date.
T1497.001:Virtualization/Sandbox Evasion : System Checks
T1497.003:Virtualization/Sandbox Evasion : Time Based Evasion
AstarionRAT is deployed via reflective PE loading from the Lua interpreter; the malicious jli.dll contains a custom reflective PE loader.
Staged Defender exclusions using Set-MpPreference -ExclusionPath "C:\ProgramData\USOShared\".
This gives the TA victim details such as MAC address, computer name, etc.
Anti-analysis includes Heaven's Gate, busy-loop sandbox evasion, and a hardcoded expiration date.
T1497.001:Virtualization/Sandbox Evasion : System Checks
T1497.003:Virtualization/Sandbox Evasion : Time Based Evasion
Malware transmits installed EDR products and checks for Defender, CrowdStrike, SentinelOne, Sophos, Trellix, Cortex XDR, and Bitdefender.
Operator next-day return used PsExec to Windows Server → DC1 → DC2 in approximately 40 minutes.
The content explicitly identifies the operator lateral-movement phase as T1021.002 and T1570.
Users were instructed to download a ZIP file from the website. Extracting and interacting with the contents of the ZIP file results in deployment of Matanbuchus.
The Matanbuchus payload connects to C&C server hxxp://collectiontelemetrysystem[.]com/cAUtfkUDaptk/ZRSeiy/requets/index.php and sends the base64-encoded POST request.
T1071.001: Application Layer Protocol: Web Protocols
Finally, Matanbuchus malware downloads two Cobalt Strike Beacons from the C&C servers.
Command & Control (TA0011) T1132.001: Standard Encoding Technique
The Teams variant uses Quick Assist to install an MSI containing HRUpdate.exe and a sideloaded downloader DLL.
319 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
55 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.