Matanbuchus = malware-as-a-service (Maas) with Beacons
Threat intelligence firm Cyble has observed a malware-as-a-service (Maas), named Matanbuchus, involved in malspam attacks dropping Cobalt Strike beacons.
Matanbuchus is a malware loader that first appeared on the threat landscape in February 2021, when it was offered for rent on Russian-speaking cybercrime forums at a price of $2500.
Cyble researchers started their investigation after coming across a Twitter post from a researcher warning of the loader spreading through spam campaigns.
2022-06-17 (Friday) – Today we saw #Matanbuchus actiity – This activity led to #CobaltStrike using gudugil[.]com on 23.82.141[.]136:443 – IOCs available at: https://t.co/0gd2wdCYqS pic.twitter.com/adgnoCueAB— Unit 42 (@Unit42_Intel) June 17, 2022
Matanbuchus could be used in a multi-stage attack chain due to its capability to download and execute second-stage executables from C2 servers.
it started with a ZIP
The Matanbuchus attack chain starts through malspam messages using a ZIP attachment containing an HTML file. Once executed the HTML file, it decodes the base64 content embedded in the file and drops a ZIP file in the Downloads folder.
“However, there is a code present in the HTML file which shows that the ZIP file is in the OneDrive location. The ZIP file contains an MSI installer file. After extraction, it shows a fake error message upon the execution of the MSI file.” reads the analysis published by Cyble.
The MSI installer displays a fake error message upon execution while installing a DLL file (“main.dll”) in the background.
The ‘main.dll’ acts as a loader and downloads the actual Matanbuchus DLL from the C&C server. The DLL also establishes persistence by means of a scheduled task.
Threat Actors
“Threat Actors use various techniques to deploy their malicious payloads into the victim’s system. In this case, we observed the TAs used Matanbuchus malware loader to deliver Cobalt Strike Beacons.” concludes Cyble.
The report also includes MITRE ATT&CK® Techniques and Indicators of Compromise.
The post New Matanbuchus Campaign drops Cobalt Strike beacons appeared first on Security Affairs.