As cited
Copy frozen at (site build).
threat intel
Technical Analysis of Matanbuchus 3.0
Zscaler ThreatLabz published technical analysis of Matanbuchus 3.0, a C++ malware downloader offered as a Malware-as-a-Service since 2020 that has evolved significantly with new obfuscation methods and network communication using Protocol Buffers. The malware establishes persistence through scheduled tasks, collects host and security product information during registration, and supports multiple payload delivery mechanisms including EXE, DLL, MSI, and shellcode execution. Recent deployments have been associated with ransomware operations and delivery of the Rhadamanthys information stealer and NetSupport remote access tool.
Why it matters: Organizations using Windows systems need to monitor for Matanbuchus indicators of compromise (IOCs) and QuickAssist abuse, as the malware is actively used in hands-on-keyboard attacks leading to ransomware deployment and data theft.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Technical Analysis of Matanbuchus 3.0
Zscaler ThreatLabz published technical analysis of Matanbuchus 3.0, a C++ malware downloader offered as a Malware-as-a-Service since 2020 that has evolved significantly with new obfuscation methods and network communication using Protocol Buffers. The malware establishes persistence through scheduled tasks, collects host and security product information during registration, and supports multiple payload delivery mechanisms including EXE, DLL, MSI, and shellcode execution. Recent deployments have been associated with ransomware operations and delivery of the Rhadamanthys information stealer and NetSupport remote access tool.
Why it matters: Organizations using Windows systems need to monitor for Matanbuchus indicators of compromise (IOCs) and QuickAssist abuse, as the malware is actively used in hands-on-keyboard attacks leading to ransomware deployment and data theft.
- Source published
- First seen by Cybersecurity Tracker