Threat intelligence firm Cyble has observed a malware-as-a-service (Maas), named Matanbuchus, involved in malspam attacks dropping Cobalt Strike beacons.
Matanbuchus is a malware loader that first appeared on the threat landscape in February 2021, when it was offered for rent on Russian-speaking cybercrime forums at a price of $2500.
Cyble researchers started their investigation after coming across a Twitter post from a researcher warning of the loader spreading through spam campaigns.
Matanbuchus could be used in a multi-stage attack chain due to its capability to download and execute second-stage executables from C2 servers.
The Matanbuchus attack chain starts through malspam messages using a ZIP attachment containing an HTML file. Once executed the HTML file, it decodes the base64 content embedded in the file and drops a ZIP file in the Downloads folder.
“However, there is a code present in the HTML file which shows that the ZIP file is in the OneDrive location. The ZIP file contains an MSI installer file. After extraction, it shows a fake error message upon the execution of the MSI file.” reads the analysis published by Cyble.
The MSI installer displays a fake error message upon execution while installing a DLL file (“main.dll”) in the background.
The ‘main.dll’ acts as a loader and downloads the actual Matanbuchus DLL from the C&C server. The DLL also establishes persistence by means of a scheduled task.
“Threat Actors use various techniques to deploy their malicious payloads into the victim’s system. In this case, we observed the TAs used Matanbuchus malware loader to deliver Cobalt Strike Beacons.” concludes Cyble.
The report also includes MITRE ATT&CK® Techniques and Indicators of Compromise.
Follow me on Twitter: @securityaffairs and Facebook
[adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Matanbuchus)
[adrotate banner=”5″]
[adrotate banner=”13″]
Threat actors are exploiting the CVE-2023-22518 flaw in Atlassian servers to deploy a Linux variant of…
Ivanti addressed two critical vulnerabilities in its Avalanche mobile device management (MDM) solution, that can…
Researchers released an exploit code for the actively exploited vulnerability CVE-2024-3400 in Palo Alto Networks'…
Cisco Talos warns of large-scale brute-force attacks against a variety of targets, including VPN services,…
The PuTTY Secure Shell (SSH) and Telnet client are impacted by a critical vulnerability that could…
Researchers warn of a renewed cyber espionage campaign targeting users in South Asia with the…
This website uses cookies.