Loading malware…
FakeMBAM is a Windows backdoor disguised as a Malwarebytes installer and associated with a 2020 supply-chain style compromise affecting the automatic update channels of Download Studio and the adblocking applications NetShield Kit, My AdBlock, and Net AdBlock. The malware was observed at scale, with infections concentrated in Russia, Ukraine, and Kazakhstan, and analysis of code and infrastructure overlaps suggested either a common operator or tightly linked actors behind the affected software ecosystem.
The malware is delivered as a counterfeit Malwarebytes installation package that silently executes in the background through compromised update mechanisms. It creates a fake Malwarebytes program directory populated with legitimate signed components alongside malicious DLLs, then abuses DLL sideloading so that a legitimate Malwarebytes executable loads a trojanized library, which in turn loads the backdoor component. Persistence is established by installing a malicious Windows service masquerading as a Malwarebytes service. The malware also modifies local system settings to facilitate execution.
Once active, FakeMBAM polls attacker-controlled infrastructure for encrypted configuration updates using custom HTTP headers and decrypts returned configuration data locally. It supports deployment of additional payloads and includes logic to maintain those payloads persistently, including reinstallation if they are removed or terminated. Observed secondary payloads included XMRig-based cryptocurrency miners. The malware can execute payloads directly or through scheduled tasks and contains functionality to run payloads under a stolen active user token, indicating post-compromise execution flexibility and elements of session abuse. Reverse-engineering also identified shared implementation details with Download Studio, including Qt usage, string obfuscation, custom header signing, and scheduled-task handling, reinforcing the assessment of a close operational relationship between the backdoor and its distribution channels.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
14 distinct techniques documented for this family, organized by ATT&CK tactic.
the malware can either run the payload directly by creating a new process, or it can create a one-time scheduled task that will execute the payload in one minute and automatically delete the task afterward
When all the setup actions are finished, the backdoor executes the file specified as payload['file'][0] while passing it payload['file'][1] on the command line.
These arguments were used to execute application updates silently in the background... the last two hashes are the fake Malwarebytes installers that we have been investigating. They were executed in the same way as all the other automatic updates, silently in the background and without the users’ awareness.
the malware can either run the payload directly by creating a new process, or it can create a one-time scheduled task that will execute the payload in one minute and automatically delete the task afterward
the malware can either run the payload directly by creating a new process, or it can create a one-time scheduled task that will execute the payload in one minute and automatically delete the task afterward
This installer attempted to pass itself off as the legitimate Malwarebytes installer, mimicking it to a great extent – it was distributed under the same filename, it used the same icon and it created a Malwarebytes installation directory containing legitimate PE files digitally signed by Malwarebytes.
These arguments were used to execute application updates silently in the background... the last two hashes are the fake Malwarebytes installers that we have been investigating. They were executed in the same way as all the other automatic updates, silently in the background and without the users’ awareness.
The actual response from the C&C server is encoded in the custom X-Payload HTTP response header... encrypted strings... are decrypted at run-time using elementary obfuscation methods
When the malware is executed as a service, it enters an infinite loop where it polls the C&C server for configuration updates... Configuration updates are performed via HTTP GET requests using custom HTTP headers.
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware disguised as Malwarebytes that was reportedly delivered via a compromised Download Studio update in 2020.
A backdoor disguised as a Malwarebytes installer that was silently distributed via abused Download Studio automatic updates; it could download additional malware.
A backdoor disguised as a Malwarebytes installer that was previously distributed via abused Download Studio automatic updates; it could download additional malware.
A backdoor delivered via abused automatic updates of Download Studio and three adblockers. It masquerades as a Malwarebytes installer, plants malicious DLLs alongside legitimate signed Malwarebytes files, creates a persistent service named MBAMSvc, stores encrypted configuration in the registry, polls a C2 server via custom HTTP headers, and can deploy additional payloads including persistent cryptocurrency miners.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.