Threat Actors Using Matanbuchus Downloader to Deliver Ransomware and Maintain Persistence
Threat actors are increasingly utilizing the Matanbuchus malicious downloader as a key component in ransomware operations. This tool is leveraged for its backdoor-like capabilities, enabling the delivery of secondary payloads, lateral movement, and…
Threat actors are increasingly utilizing the Matanbuchus malicious downloader as a key component in ransomware operations. This tool is leveraged for its backdoor-like capabilities, enabling the delivery of secondary payloads, lateral movement, and long-term persistence on compromised systems.
Initially identified in 2020 and offered as Malware-as-a-Service (MaaS), Matanbuchus has evolved, with version 3.0 appearing in the wild in July 2025. This version introduced advanced network serialization and encryption features.
Matanbuchus, written in C++, functions primarily as a downloader and backdoor. It is designed to fetch and execute additional payloads, consisting of two main components: a downloader module and a main module. The downloader retrieves and launches the main module, which supports a command-and-control (C2) framework allowing execution of binaries, scripts, shellcode, and .NET payloads directly in memory.
Recent observations by Zscaler ThreatLabz indicate that attackers used Microsoft's QuickAssist, likely with social engineering, to gain remote access to systems. Post-access, a malicious Microsoft Installer (MSI) package was executed, sideloading a malicious DLL. This DLL acted as the Matanbuchus downloader, retrieving the main module from a remote C2 endpoint.
Matanbuchus employs extensive obfuscation and anti-analysis techniques. It uses the ChaCha20 stream cipher for string encryption, dynamic Windows API function resolution through MurmurHash-based hashing, and junk instructions to impede static analysis. The downloader also uses long-running loops to delay execution, evading sandbox timeouts.
Network communication is hardened with encrypted shellcode, decrypted using a brute-force method against ChaCha20 keys. This shellcode downloads the main module over HTTPS, decrypting it using ChaCha20 for efficient payload processing. Version 3.0 employs Protocol Buffers (Protobufs) for C2 message serialization, encrypting data in custom packets.
Threat actors are increasingly utilizing the Matanbuchus malicious downloader as a key component in ransomware operations.
After deployment, the main module registers the compromised host with the C2 server, exfiltrating host and user information. It creates a registry marker and establishes persistence through a scheduled task named "Update Tracker Task," launching a copy of the malware stored under the APPDATA folder.
Matanbuchus acts as a full-featured backdoor, supporting commands to download and run executables, DLLs, MSI packages, and shellcode. It can enumerate processes, execute system commands, and terminate itself. The malware has been used to distribute the Rhadamanthys information stealer and the NetSupport RAT, highlighting its versatility.
SHA256 Hash Description
92a2e2a124a106af33993828fb0d4cdffd9dac8790169774d672c30747769455 Matanbuchus MSI package
6246801035e053df2053b2dc28f4e76e3595fb62fdd02b5a50d9a2ed3796b153 Legitimate executable file (HRUpdate.exe) used for sideloading the downloader module
3ac90c071d143c3240974618d395fa3c5228904c8bf0a89a49f8c01cd7777421 Matanbuchus downloader module
77a53dc757fdf381d3906ab256b74ad3cdb7628261c58a62bcc9c6ca605307ba Matanbuchus main module
gpa-cro[.]com URL of malicious MSI file
mechiraz[.]com Matanbuchus C2 server
Based on reporting by GBHackers.