Matanbuchus

Matanbuchus is a Windows malware loader sold as Malware-as-a-Service (MaaS), written in C++, and advertised on underground forums since February 2021 by the developer BelialDemon. It is primarily used to download and execute second-stage payloads on victim systems and has been observed delivering Cobalt Strike, Qbot/QakBot, Rhadamanthys, NetSupport RAT, Remcos RAT, DanaBot, SystemBC, CastleRAT/NightShadeC2, and AstarionRAT. Reporting also links it to campaigns that can lead to ransomware deployment, data theft, fraud, or account takeover.

Earlier reporting describes Matanbuchus as a two-stage DLL-based loader. The first stage performs environment and anti-analysis checks before loading the main module. The second stage gathers host reconnaissance including domain, computer name, privilege level, process path, CPU and architecture details, RAM, DNS domain, and MAC address, then sends this data to command-and-control infrastructure as encrypted JSON. Documented anti-analysis behavior includes CIS-language checks, checking for specific paths such as %ProgramFiles%\Opera\Opera.exe, dynamic API resolution, string obfuscation, anti-debugging, and sandbox-evasion delays. Observed command support includes downloading and executing EXEs, DLLs, and MSIs, running CMD and PowerShell commands, executing payloads in memory, self-update, uninstall, and sleep.

Version 3.0, observed in the wild in July 2025 and active through at least February 2026, is described as a complete rewrite. It uses Protobuf-serialized C2 over HTTPS, ChaCha20 encryption, MurmurHash3-based API resolution, Heaven’s Gate WoW64 bypass, busy-loop evasion, hardcoded expiration logic, and dual DLL sideloading chains. It enumerates more than 70 EDR products and reports the security stack to the C2 so operators can choose execution methods. Supported payload formats include EXE, DLL, MSI, shellcode, PowerShell, CMD, and WMI. Persistence has been observed via a scheduled task named "Update Tracker Task" invoking msiexec with the uncommon -z flag.

Observed infection vectors include phishing and spear-phishing, malicious MSI installers, HTML smuggling, spam campaigns, compromised websites, ClickFix social engineering, and Microsoft Teams/Quick Assist abuse. Documented lures include OneDrive-themed scanned-document HTML attachments, fake Adobe Font Pack installers, fake browser or certificate warnings, and ClickFix prompts instructing victims to paste malicious commands into PowerShell or the Run dialog. In one 2022 campaign, an HTML-smuggled ZIP delivered an MSI signed with a revoked Westeast Tech Consulting, Corp. certificate; the MSI dropped main.dll and notify.vbs under C:\Users\username\AppData\Local\AdobeFontPack and executed the DLL via regsvr32.exe. In 2025-2026 ClickFix campaigns, msiexec was used to silently fetch remote MSI content, leading to Matanbuchus 3.0 deployment and subsequent hands-on-keyboard activity.

Technical analyses of newer chains show Matanbuchus using DLL sideloading with legitimate binaries such as Zillya! AVCore.exe and java.exe. One documented second-stage package contained java.exe, a malicious jli.dll, and an encrypted Lua script named SySUpd in a Temp directory. The malicious jli.dll unhooked kernel32.dll and ntdll.dll using clean copies from \KnownDlls\, initialized an embedded Lua 5.4.7 interpreter, decrypted SySUpd with a rolling XOR key, and executed Lua that allocated RWX memory and ran encoded shellcode. Related reporting states Matanbuchus 3.0 downloaded its main module from hxxps://marle[.]io/check/updprofile.aspx, with another listed URL hxxps://mechiraz[.]com/cart/checkout/files/update_info.aspx.

Matanbuchus has been associated with multiple threat actors and clusters. It was originally linked by Mandiant to UNC4487, a suspected espionage actor observed compromising Ukrainian government-related websites and a Ukrainian auto insurance website to socially engineer targets into executing Matanbuchus or CHILLYHELL. Other reporting attributes campaigns to BelialDemon, notes use by Conti-associated activity, and describes deployment in the Fortgale-tracked "FortiSync Quasar" intrusion attributed to Mora_001. It has also been observed in TA571 and ClearFake/ClickFix-related delivery chains.

Targeting and outcomes vary by campaign. Reported targets include Ukrainian government entities, users reached through spam or compromised websites, and enterprise victims in scenarios consistent with ransomware staging, espionage, credential theft, and financial account takeover. In one December 2025 intrusion, a malicious MSI delivered Matanbuchus, followed by NetSupport RAT, Remcos RAT, and CastleRAT/NightShadeC2; the actor harvested browser credentials and attempted logins to financial-institution websites from the victim host. In February 2026 Huntress documented a ClickFix case where Matanbuchus 3.0 led to AstarionRAT and rapid lateral movement toward servers and domain controllers.

High-confidence indicators mentioned in the content include C2 or delivery infrastructure such as 193.56.146[.]60, 193.56.146[.]61, 193.56.146[.]62, 193.56.146[.]65, 172.86.123[.]222, telemetrysystemcollection.com, collectiontelemetrysystem.com, marle[.]io, mechiraz[.]com, gpa-cro[.]com, and binclloudapp[.]com; paths and artifacts such as C:\Users\username\AppData\Local\AdobeFontPack\main.dll, notify.vbs, %WINDIR%\SysWOW64\msiexec.exe -z <path>, and fake-vendor directories under %APPDATA%; and hashes including b9b399dbb5d901c16d97b7c30cc182736cd83a7c53313194a1798d61f9c7501e (second-stage sample), 8833f28dc0cadd4b3c5676981b2a76e1c0683f2e2b8e3dac8270622c12e032ef (2022 DLL), and 5dcbffef867b44bbb828cfb4a21c9fb1fa3404b4d8b6f4e8118c62addbf859da (2022 MSI).