MatanbuchusMalware
According to PCrisk, Matanbuchus is a loader-type malicious program offered by its developers as Malware-as-a-Service (MaaS). This piece of software is designed to cause chain infections. Since it is used as a MaaS, both the malware it infiltrates into systems, and the attack reasons can vary - depending on the cyber criminals operating it.From MISP Galaxy
Last reported 4 months ago, by Huntress5 reports
ATT&CK techniques
6 of 33 · each with the sentence it comes from- T1036Masquerading
“Persistence was registered under the user Run key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EdgeUpdate, masquerading as a benign Edge auto-updater entry.”
- T1053.005Scheduled Task
“With AstarionRAT active on the initial endpoint, the operator established persistence via a scheduled task named Application Maintenance, configured to execute Core.exe from C:\ProgramData\2895e798a2579e6\.”
- T1684Social Engineering
“…uary 2026, the Huntress Tactical Response team and SOC responded to a hands-on intrusion that began with a ClickFix infection, the social engineering technique that just won't die.”
- T1027.007Dynamic API Resolution
“The list below includes DLL names for dynamic API resolution, User-Agent strings, WQL queries, registry paths, format strings, and EDR process names used for security product detection:”
- T1055Process Injection
“Process injection and module management”
- T1620Reflective Code Loading
“With 24 commands, RSA-encrypted C2 traffic disguised as application telemetry, a SOCKS5 proxy, credential theft, reflective code loading, and port scanning capabilities,”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack“Huntress previously documented a ClickFix case in February involving lateral movement and the delivery of malware-as-a-service loader Matanbuchus and a novel custom implant called AstarionRAT.”
-
ClickFix tactic: The Phantom Meet Infostealer Campaign“…s primarily used HTML files disguised as Word documents, displaying a fake error window that prompts users to install malware such as Matanbuchus, DarkGate, or NetSupport RAT via a PowerShell script.”
-
PikaBot: a Guide to its Deep Secrets and Operations“Specifically, PikaBot shares code similarities with Matanbuchus regarding traffic and string encryption, while its TLS certificate pattern for Command & Control (C2) infrastructure is similar to the Qakbot one.”
-
A New RAT and a Hands-on-Keyboard Intrusion“Neither Will Matanbuchus.”
-
Dusting for fingerprints: ShadowSyndicate, a new RaaS player?“The tools and malware used by the attackers included Cobalt Strike, Sliver, IcedID, and Matanbuchus.”
Indicators in its reports
named in the reports above- meet.googie.com-join[.]usin 1 report
- meet.google.web-join[.]comin 1 report
- meet.google.cdm-join[.]usin 1 report
- hxxps://meet.google.com-join[.]us/wmq-qcdn-orjin 1 report
- meet.google.com-join[.]usin 1 report
- hxxps://meet.google.us-join[.]com/ywk-batf-sfhin 1 report
- meet.google.us-join[.]comin 1 report
- hxxps://meet.google.us07host[.]com/coc-btru-aysin 1 report
- meet.google.us07host[.]comin 1 report
- hxxps://meet.google.webjoining[.]com/exw-jfaj-hpain 1 report
- meet.google.webjoining[.]comin 1 report
- hxxps://googiedrivers[.]com/fix-errorin 1 report
- googiedrivers[.]comin 1 report
- 92a8cc4e385f170d…bee9e3453138in 1 report
- a834be6d2bec10f3…58df183f773cin 1 report
- 2853a61188b4446b…743b1a44cbfein 1 report
- hxxp://95.182.97[.]58/84b7b6f977dd1c65.php%E2%80%9Din 1 report
- 95.182.97[.]58in 1 report
- hxxp://91.103.140[.]200:9078/3936a074a2f65761a5eb8/6fmfpmi7.fwf4p%E2%80%9Din 1 report
- 91.103.140[.]200in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.