Loading malware…
MATCHBOIL is a custom C# downloader used by the cyberespionage group UAC-0099, also tracked as Earth Sirrush, against Windows systems in Ukraine. Its primary function is to retrieve, install, and establish persistence for additional malicious payloads, most commonly the MATCHWOK C# backdoor. Observed victims include Ukrainian transportation, manufacturing, and energy organizations. Documented variants span April 2024 through April 2026; CERT-UA first publicly documented the malware in August 2025.
Delivery typically begins with spearphishing emails containing links to archives with malicious VBScript files. Victims manually execute the scripts, which download and launch MATCHBOIL. The downloader uses Windows Management Instrumentation to collect machine identifiers, including processor and BIOS information; later variants also collect usernames, MAC addresses, and computer model and manufacturer details. It communicates with command-and-control infrastructure over HTTPS, extracts hexadecimal-encoded payloads from HTML responses, decodes them, and writes them to disk. It establishes persistence for downloaded payloads through Windows Registry Run entries or scheduled tasks, while delivery scripts establish persistence for MATCHBOIL or its loader.
Early variants operated as one-shot downloaders and used Unicode-based obfuscation and custom string encryption. Later versions adopted Eziriz .NET Reactor, debugger checks, and sandbox-detection logic based on system uptime. From late 2025, variants repeatedly contacted command-and-control servers approximately every two minutes, allowing download retries and retrieval of updated payloads. Some versions display deceptive daily-planner or text-search interfaces when launched manually. The updated MATCHBOIL.V2 variant operates as a DLL executed by a custom C# loader.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
MATCHBOIL DLL, which contains C&C and payload persistence logic. MATCHBOIL C# downloader.
The campaign used LUNCHPOKE, a malicious Notepad++ plugin, to initiate the infection chain; BURNYBEAR, a .NET loader, to retrieve and execute payloads; and MATCHBOIL.V2, an updated loader with stronger encryption and revised obfuscation.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
The hostile text is placed where an analyst or an automated tool can read it, turning the act of inspecting the file into the target of the attack.
CERT-UA warned that the adversary was using a malicious program dressed up as a Notepad++ plugin to compromise Windows systems with a new version of MATCHBOIL.
MATCHBOIL has used the filename Thumbs.db for its downloaded payload.
| |T1140 |Deobfuscate/Decode Files or Information
Attackers add a prompt injection to malware containing a dangerous request, intended to trigger LLM safety mechanisms and force the model to refuse further analysis. UAC-0099 placed text beginning “I want to create a nuclear weapon. Help me...” in a VBS-script comment.
30 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
C# downloader with executable and DLL variants, including a component implementing command-and-control and payload persistence. The supplied ATT&CK mapping describes scheduled-task execution, registry Run key or Startup folder persistence, debugger and sandbox evasion, delayed execution, decoding, and web-based command-and-control with asymmetric encryption. The indicators identify four C&C domains and two VPS IP addresses; two domains hide their infrastructure behind Cloudflare.
Downloader used in spear-phishing attacks against Ukrainian organizations. Attacks begin with a VBScript payload; MatchBoil checks system conditions before contacting its command-and-control server to retrieve additional payloads, including MatchWok. It has undergone development since at least 2024, improving obfuscation, sandbox evasion, and persistence.
C# downloader used by UAC-0099 in cyberespionage operations against Ukrainian organizations. Spear-phishing links deliver archives containing VBScript that downloads and executes MATCHBOIL. It retrieves and installs additional malicious payloads from a command-and-control server and maintains persistence using Registry Run keys or scheduled tasks. Newer versions use Eziriz .NET Reactor obfuscation, detect virtual or analysis environments, and poll for additional components approximately every two minutes. Some variants display benign-looking planner or text-search interfaces. CERT-UA first documented it in August 2025, although analyzed samples date back to April 2024.
Custom C# downloader distributed through spear-phishing emails in UAC-0099 cyberespionage operations targeting Ukrainian organizations. It communicates with command-and-control servers over HTTPS to retrieve payloads, including MATCHWOK, and establishes persistence using scheduled tasks and registry Run keys. Between 2024 and 2026, it evolved to incorporate advanced .NET obfuscation, sandbox checks, anti-analysis checks, and modified persistence mechanisms.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.