Loading malware…
FakeMBAM is a Windows backdoor disguised as a Malwarebytes installer and associated with a large-scale supply-chain style distribution campaign that abused the automatic update mechanisms of Download Studio and the adblocker applications NetShield Kit, My AdBlock, and Net AdBlock. Activity was observed at significant scale, with infections concentrated in Russia, Ukraine, and Kazakhstan, and the campaign appears intended to reach the full user bases of the affected applications. Code and infrastructure overlaps between the distributors and the malware suggest either a common operator or a closely connected compromise.
The malware is installed through a counterfeit Malwarebytes package that silently creates a fake Malwarebytes directory populated with legitimate signed components alongside malicious DLLs. Execution relies on DLL sideloading: a trojanized Qt component causes the legitimate Malwarebytes executable to load a malicious library that implements the backdoor. Persistence is established by creating a Windows service masquerading as a Malwarebytes service, and the malware also modifies host settings to facilitate execution.
Once active, FakeMBAM polls attacker-controlled infrastructure for encrypted configuration updates using custom HTTP headers and cryptographic validation. It stores encrypted configuration locally and supports retrieval and deployment of additional payloads. Observed secondary payloads included persistent XMRig-based cryptocurrency miners. The malware can execute payloads directly or via scheduled tasks, periodically reinstall removed payloads, and in some cases attempt to run payloads under a stolen active user token. Its behavior demonstrates defense evasion, persistence, post-compromise payload delivery, and monetization through cryptomining.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
14 distinct techniques documented for this family, organized by ATT&CK tactic.
the malware can either run the payload directly by creating a new process, or it can create a one-time scheduled task that will execute the payload in one minute and automatically delete the task afterward
When all the setup actions are finished, the backdoor executes the file specified as payload['file'][0] while passing it payload['file'][1] on the command line.
These arguments were used to execute application updates silently in the background... the last two hashes are the fake Malwarebytes installers that we have been investigating. They were executed in the same way as all the other automatic updates, silently in the background and without the users’ awareness.
the malware can either run the payload directly by creating a new process, or it can create a one-time scheduled task that will execute the payload in one minute and automatically delete the task afterward
the malware can either run the payload directly by creating a new process, or it can create a one-time scheduled task that will execute the payload in one minute and automatically delete the task afterward
This installer attempted to pass itself off as the legitimate Malwarebytes installer, mimicking it to a great extent – it was distributed under the same filename, it used the same icon and it created a Malwarebytes installation directory containing legitimate PE files digitally signed by Malwarebytes.
These arguments were used to execute application updates silently in the background... the last two hashes are the fake Malwarebytes installers that we have been investigating. They were executed in the same way as all the other automatic updates, silently in the background and without the users’ awareness.
The actual response from the C&C server is encoded in the custom X-Payload HTTP response header... encrypted strings... are decrypted at run-time using elementary obfuscation methods
When the malware is executed as a service, it enters an infinite loop where it polls the C&C server for configuration updates... Configuration updates are performed via HTTP GET requests using custom HTTP headers.
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor disguised as a Malwarebytes installer that was silently distributed via abused Download Studio automatic updates; it could download additional malware.
A backdoor disguised as a Malwarebytes installer that was previously distributed via abused Download Studio automatic updates; it could download additional malware.
A backdoor delivered via abused automatic updates of Download Studio and three adblockers. It masquerades as a Malwarebytes installer, plants malicious DLLs alongside legitimate signed Malwarebytes files, creates a persistent service named MBAMSvc, stores encrypted configuration in the registry, polls a C2 server via custom HTTP headers, and can deploy additional payloads including persistent cryptocurrency miners.
A backdoor delivered via abused automatic updates of Download Studio and three adblockers. It masquerades as a Malwarebytes installer, creates a fake Malwarebytes installation directory, installs persistence via a malicious service (MBAMSvc), polls a C2 server for encrypted configuration updates, and can deploy additional payloads including persistent cryptocurrency miners.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.