Loading malware…
Matanbuchus is a Windows malware-as-a-service loader sold on Russian-speaking cybercrime forums since 2021 and commonly associated with the threat actor BelialDemon. It is designed as a staged loader used to retrieve and execute additional payloads on compromised systems, and has been observed delivering follow-on malware including QakBot and Cobalt Strike. Multiple analyses describe it as an obfuscated two-stage loader or loader-plus-core architecture that uses dynamic API resolution, string obfuscation, anti-analysis checks, and in-memory execution to reduce detection and complicate reverse engineering.
Matanbuchus commonly appears in phishing and malspam infection chains, including HTML-smuggling lures, malicious ZIP archives, and MSI-based installers masquerading as legitimate software or updates. It has also been observed in ClickFix-style social-engineering chains and in campaigns using malicious Excel documents. MSI installers associated with Matanbuchus have used custom actions to launch the loader through regsvr32 while displaying decoy error messages to the victim.
On execution, Matanbuchus performs environment and anti-sandbox checks such as debugger detection, timing-based evasion, process-count checks, mutex gating, and other host validation logic. It establishes persistence through scheduled tasks that repeatedly invoke regsvr32 against a dropped DLL or OCX-style component. The malware communicates with command-and-control infrastructure over HTTP or HTTPS, often using encoded or encrypted JSON-like data, and has been documented using RC4-protected values in network traffic. Its tasking supports downloading and executing additional payloads, running DLLs and executables, loading shellcode, invoking PowerShell or command shells, upgrading itself, and uninstalling. Several variants manually map downloaded PE payloads directly into memory and execute exports or entry points without writing the final stage to disk.
Matanbuchus has been used in cybercrime delivery ecosystems tied to spam operations and post-compromise tooling, and has appeared alongside crypters used by actors linked to broader loader and ransomware-adjacent activity. Reported targeting has included technology and education organizations, while its broader use pattern is consistent with opportunistic financially motivated intrusion activity against Windows environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
MatanBuchus is a Malware-as-a-Service (MaaS) platform developed by the threat actor BelialDemon and identified on Russian cybercrime forums in early 2021. Operating as a second-stage malware loader, MatanBuchus contains functionality to download and execute malicious payloads, run arbitrary PowerShell commands, and conduct stealthy C2 server communications.
If the “Auto-fix” button was clicked, the search-ms protocol displayed a similar WebDAV-hosted “fix.msi” or “fix.vbs” in Windows Explorer... This led to the installation of Matanbuchus.
According to threat intelligence shared by Google Mandiant, UNC4487 is a suspected espionage actor that has been observed compromising the websites of Ukrainian government entities to redirect and socially engineer targets to execute Matanbuchus or CHILLYHELL malware.
The campaign, internally dubbed "FortiSync Quasar," revealed an evolution from ransomware operations to strategic espionage, deploying Matanbuchus 3.0, Astarion RAT, and SystemBC.
“uses ClickFix techniques to deliver CastleLoader and Matanbuchus”
28 distinct techniques documented for this family, organized by ATT&CK tactic.
To establish persistence, the malware creates a scheduled task to run the 8c01.nls file with a specific function by using the following command line.
"C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /MO 3 /TN %PROCESSOR_REVISION% /TR "%windir%\system32\regsvr32.exe -e %local_ocx_path%"
However, in the background, the MSI installer drops a Dynamic Link Library (DLL) and VBS file... The malware uses the VBS file to show fake error messages.
Except for the 1st entry (“Vs”), which is used as a no-op command, the others are rather descriptive... Run PS in memory
crypters, which are also referred to as loaders or packers, are applications designed to encrypt and obfuscate malware to evade detection by antivirus (AV) scanners and hinder analysis.
In the latest version of MATANBUCHUS, the malware dynamically resolves its API to avoid exposing its functionality through its import table.
The HTML file pretends to be a OneDrive page... MSI package pretends to install an Adobe font pack. Installation process presents a fake error message.
The next obfuscation that MATANBUCHUS uses is string encryption... The DWORD64 number is used as the XOR value to decode the string.
We start our analysis with the MSI installer package... It disguises itself as a Visual Studio installer
launching it through Regsvr32.exe ... this task will execute the regsvr32.exe command to register the downloaded DLL
Before downloading the DLL file, it calls APIs such as IsProcessorFeaturePresent(), GetSystemTimeAsFileTime(), IsDebuggerPresent(), QueryPerformanceCounter() and cpuid to ensure that the malware is not running under a controlled environment such as VMware, Sandbox, etc.
Both functions share an anti-sandbox check by checking for the number of processes running on the system... checks if it is less than 50.
This gives the TA victim details such as MAC address, computer name, etc.
Before downloading the DLL file, it calls APIs such as IsProcessorFeaturePresent(), GetSystemTimeAsFileTime(), IsDebuggerPresent(), QueryPerformanceCounter() and cpuid to ensure that the malware is not running under a controlled environment such as VMware, Sandbox, etc.
The Matanbuchus payload connects to C&C server hxxp://collectiontelemetrysystem[.]com/cAUtfkUDaptk/ZRSeiy/requets/index.php and sends the base64-encoded POST request.
Finally, Matanbuchus malware downloads two Cobalt Strike Beacons from the C&C servers.
295 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
51 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A premium C++ malware loader sold as MaaS that performs adaptive payload delivery by enumerating installed EDR products, reporting them to C2, and allowing operators to choose execution methods accordingly. It supports multiple payload formats, uses Protobuf-over-HTTPS with ChaCha20 encryption, employs Heaven's Gate and DLL sideloading for evasion, and has delivered RATs, stealers, Cobalt Strike, and unspecified ransomware.
A malware-as-a-service loader referenced as used in a prior ClickFix case.
Loader used in a related ClickFix campaign to deliver MIMICRAT.
Malware-as-a-service loader delivered via ClickFix campaigns; used as a foothold to rapidly progress to lateral movement and domain controller access, with the stated objective to deploy ransomware or exfiltrate data.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.