Loading malware…
MATCHBOIL.V2 is an updated C#-based Windows loader used by UAC-0099, a threat cluster overlapping with the Russia-aligned espionage group Earth Sirrush. It downloads and executes additional malicious payloads, creates scheduled tasks for persistence, and updates its configuration, including command-and-control server addresses. Compared with earlier MATCHBOIL versions, it incorporates stronger encryption and revised concealment. It uses WinRAR to extract downloaded components and can retrieve the utility from Dropbox when it is absent.
MATCHBOIL.V2 has been deployed in phishing campaigns against Ukrainian organizations. The infection chain uses emailed images linking to hosted archives containing VBScript files disguised as documents through concealed double extensions. Executing the script retrieves a decoy document and a package containing legitimate Notepad++ software with the malicious LUNCHPOKE plugin. Notepad++ loads LUNCHPOKE through its normal plugin mechanism; LUNCHPOKE deploys BURNYBEAR, which loads MATCHBOIL.V2. The loader provides persistent follow-on payload delivery within the broader intrusion.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
UAC-0099 : nouveaux outils LUNCHPOKE, BURNYBEAR et MATCHBOIL.V2 via DLL hijacking Notepad++
LUNCHPOKE deploys BURNYBEAR, a .NET loader, and MATCHBOIL.V2, an updated loader with stronger encryption and revised concealment.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
The infection chain typically begins with a phishing email containing an image attachment.
When the user clicks the image, a hyperlink often routed through a URL-shortening service is activated and redirects the user to a file-hosting platform.
A scheduled task named \W1n3r-U09oTy-Ap5\Updates is subsequently created on the system. To maintain persistence, the task launches “RemoteLibUpdater.exe” with the setup nodisplay arguments every three minutes.
У згаданому архіві міститься VBS-скрипт... у разі запуску скрипт забезпечить завантаження файлу-приманки...
RemoteLibUpdater.exe is BURNYBEAR, a loader whose job is to execute InitTest.dll. That DLL is a modified version of MATCHBOIL
У згаданому архіві міститься VBS-скрипт із подвійним розширенням... У свою чергу, у разі запуску скрипт забезпечить завантаження файлу-приманки...
A scheduled task named \W1n3r-U09oTy-Ap5\Updates is subsequently created on the system. To maintain persistence, the task launches “RemoteLibUpdater.exe” with the setup nodisplay arguments every three minutes.
A scheduled task named \W1n3r-U09oTy-Ap5\Updates is subsequently created on the system. To maintain persistence, the task launches “RemoteLibUpdater.exe” with the setup nodisplay arguments every three minutes.
These scripts download PNG images, extract embedded ZIP archives from pixel data, and deploy executables.
The ZIP file contains a Visual Basic Script (VBScript) that masquerades as a PDF document.
ASHVEIN, MATCHBOIL, and DRAGSTARE use an identical byte-swap XOR string encryption algorithm with per-variant seed constants.
...захищений паролем архів "updater.rar" та виконуваний файл WinRAR "winrar.exe"... використання WinRAR для видобування вмісту завантажених об'єктів...
The new version retains its core functions scheduled-task persistence, configuration updates including command-and-control addresses, and downloading additional payloads
The dropper downloads TFU_up.bin ... and saves it to C:\Users\Public\Documents\TFU_up.exe.
51 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.