Researchers warned that the Matanbuchus downloader malware keeps altering its components to bypass antivirus and machine learning detections.
Threat actors now use Microsoft Installer (MSI) files to deliver the downloader, with some samples showing zero detections on VirusTotal.
This update highlights the malware’s ongoing evolution as a Malware-as-a-Service (MaaS) tool linked to ransomware operations.
Matanbuchus operators frequently modify code sections, strings, and payloads to avoid signature-based AV scans, as reported by ZScaler.
They insert junk code, encrypt strings with ChaCha20, and resolve Windows APIs by hash using MurmurHash.
Busy loops delay execution, frustrating sandbox analysis with short timeouts. These changes make static detection unreliable, forcing defenders to rely on behavior monitoring.
The latest samples use MSI files hosted on attacker-controlled domains to drop the downloader DLL via side-loading legitimate executables like HRUpdate.exe.
One analyzed hash 6a1398395f5434aa39c5074833698b0a85967eb01d76273ef8762fb149136382 evaded all AV engines initially. The downloader then fetches the main module over HTTPS, using Protocol Buffers encrypted with ChaCha20.
Technical Breakdown
Matanbuchus splits into a downloader and main module, both heavily obfuscated. The downloader gathers system intel like hostname, OS version, domain, and security tools before C2 check-in.
It detects EDR products such as BitDefender (bdagent.exe), ESET (ekrn.exe), and Symantec (ccsvchst.exe).
C2 communication hides in POST requests with base64-encoded, ChaCha20-encrypted JSON or Protobufs.
Commands support EXE/DLL/MSI execution, shellcode injection, PowerShell/CMD shells, and process hollowing via msiexec.exe. A new C2 example is https://nady[.]io/check/robot.aspx, confirming active infrastructure.
Attack Chain and Impact
Initial access often starts with social engineering via QuickAssist or Teams calls posing as IT support. Attackers trick users into running MSI or ZIP archives, leading to Notepad++ updater side-loading.
Post-infection, Matanbuchus deploys stealers like Rhadamanthys or RATs like NetSupport, paving the way for ransomware.
Zscaler links these intrusions to hands-on-keyboard ransomware prep, with tasks like “Update Tracker Task” for persistence.
Version 3.0 adds WQL queries, indirect syscalls, and enriched EDR evasion. Targets span enterprises, with campaigns since 2020 evolving into targeted ops.
Block known C2s like nady[.]io, mechiraz[.]com, and gpa-cro[.]com at firewalls. Enable behavior detection for DLL side-loading, unusual msiexec.exe use, and ChaCha20 traffic. Patch QuickAssist exploits and train users against fake IT calls.
Use EDR with ML for anomaly spotting, as signatures fail against modular changes. Zscaler detects it as Win32.Backdoor.Matanbuchus; monitor for scheduled tasks and API hashing. Hunt for IOCs like the VT hash and MSI droppers in logs.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
