Loading malware…
Matsnu is a Windows x86 malware family that functions as a backdoor and has also been referred to in some reporting under names including WVT, Injector, Rannoh, and Ransomlock.P. It uses both hardcoded domains and a domain generation algorithm to locate command-and-control infrastructure, generating candidate domains from predefined dictionaries and date-derived values. Matsnu communicates over HTTP, encrypting outbound victim data with RSA and protecting inbound responses with AES combined with a custom XOR-based routine.
After execution, Matsnu establishes persistence by copying itself into user-accessible directories and creating autorun entries in the current user context. It uses mutexes as infection markers, attempts to remove the original executable, and may create a temporary batch script to complete self-deletion. The malware employs multiple anti-analysis measures, including layered packing, runtime string decryption, anti-debugging, and anti-disassembly tricks. It also transfers execution into a newly created suspended child process, supporting stealthier execution.
Matsnu performs extensive host profiling during initial beaconing, collecting system, user, hardware, language, storage, antivirus, and virtualization-related information. Supported command-and-control tasks include waiting for further instructions, collecting additional configuration data such as process and DLL listings, executing supplied payloads, and downloading or upgrading additional binaries. Some upgrade workflows can stage payloads for execution via RunOnce and force a reboot.
Matsnu has been associated with the Avalanche criminal infrastructure, which was used for malware distribution and resilient fast-flux command-and-control operations. The malware targets Microsoft Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Browsing Website : - Compromised website : one website has been compromised either using a vulnerability (usually on outdated CMS) or using stolen credentials from owner, modified to redirect visitors to the infection.
Chat/mail - link to compromised website or exploit kit - binary as attachement, or document with link to the exploit kit
Allocate two memory chunks with sizes 0x50 and 0x13e00 bytes in the newly created process. Copy the code in the newly allocated region of memory... Set the newly created process thread context (EIP register is set to the address of the first payload) and resume thread execution.
The malware is packed multiple times using manual and UPX encryption. All strings are encrypted and encoded in the process memory. Decryption takes place only when needed by the malware.
Each packet sent by the client to the C&C server is encrypted using an RSA public key and stored in memory. After encryption, the data is base64 encoded and sent as an HTTP packet content to the server.
Select a new process name that will start in a suspended state. The malware has a predefined base64-encoded and encrypted list of processes. The infected process name is chosen using a random generator.
Allocate two memory chunks with sizes 0x50 and 0x13e00 bytes in the newly created process. Copy the code in the newly allocated region of memory... Set the newly created process thread context (EIP register is set to the address of the first payload) and resume thread execution.
The infected process tries to delete the original malware file via the “DeleteFile” and “MoveFileEx” (which uses “MOVEFILE_DELAY_UNTIL_REBOOT” flag) functions.
PROCLIST Specifies names of processes. If at least one specified process is present in the system, information is sent to the C&C server with a list of the processes present.
The following operating system and hardware information is collected: User name. Computer name... Windows subsystem version... Processor info... Graphical card information... Drive information...
DLLLIST Specifies names of files. If at least one specified file is present in the system, information is sent to the C&C server with a list of the files present.
The Matsnu malware is an x86 infector that acts as a backdoor after it infiltrates a computer system. The malware uses DGA to communicate with the C&C server.
The following URL is used: (http|ftp|htpps)://${domain-name}/${resource}${RESOURCE_QUERY_PARAM}
Avalanche used fast-flux DNS, a technique to hide the criminal servers, behind a constantly changing network of compromised systems acting as proxies.
UPGRADEURL This command is responsible for downloading data from a specified URL... LOAD This command is responsible for downloading data from the specified URL.
104 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Botnet malware family that leveraged Avalanche communication infrastructure.
Botnet/malware family using Avalanche infrastructure.
A malware family operated via Avalanche in campaigns involving credential harvesting and online banking fraud.
Malware family hosted on Avalanche infrastructure; described as a Windows-encryption trojan horse, indicating file-encryption and ransom-related capability.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.