New Matanbuchus Campaign drops Cobalt Strike beaconsSecurity Affairs

Matanbuchus malware-as-a-service (Maas) has been observed spreading through phishing campaigns, dropping Cobalt Strike beacons.

Threat intelligence firm Cyble has observed a malware-as-a-service (Maas), named Matanbuchus, involved in malspam attacks dropping Cobalt Strike beacons.

Matanbuchus is a malware loader that first appeared on the threat landscape in February 2021, when it was offered for rent on Russian-speaking cybercrime forums at a price of $ 2500.

Cyble researchers started their investigation after coming across a Twitter post from a researcher warning of the loader spreading through spam campaigns.

Matanbuchus could be used in a multi-stage attack chain due to its capability to download and execute second-stage executables from C2 servers.

The Matanbuchus attack chain starts through malspam messages using a ZIP attachment containing an HTML file. Once executed the HTML file, it decodes the base64 content embedded in the file and drops a ZIP file in the Downloads folder.

“However, there is a code present in the HTML file which shows that the ZIP file is in the OneDrive location. The ZIP file contains an MSI installer file. After extraction, it shows a fake error message upon execution of the MSI file. ” reads the analysis published by Cyble.

The MSI installer displays a fake error message upon execution while installing a DLL file (“main.dll”) in the background.

The ‘main.dll’ acts as a loader and downloads the actual Matanbuchus DLL from the C&C server. The DLL also establishes persistence by means of a scheduled task.

“Threat Actors use various techniques to deploy their malicious payloads into the victim’s system. In this case, we observed the TAs used Matanbuchus malware loader to deliver Cobalt Strike Beacons. ” concludes Cyble.

The report also includes MITER ATT & CK® Techniques and Indicators of Compromise.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs hacking, Matanbuchus)




Source

Matanbuchus malware-as-a-service (Maas) has been observed spreading through phishing campaigns, dropping Cobalt Strike beacons.

Threat intelligence firm Cyble has observed a malware-as-a-service (Maas), named Matanbuchus, involved in malspam attacks dropping Cobalt Strike beacons.

Matanbuchus is a malware loader that first appeared on the threat landscape in February 2021, when it was offered for rent on Russian-speaking cybercrime forums at a price of $ 2500.

Cyble researchers started their investigation after coming across a Twitter post from a researcher warning of the loader spreading through spam campaigns.

Matanbuchus could be used in a multi-stage attack chain due to its capability to download and execute second-stage executables from C2 servers.

The Matanbuchus attack chain starts through malspam messages using a ZIP attachment containing an HTML file. Once executed the HTML file, it decodes the base64 content embedded in the file and drops a ZIP file in the Downloads folder.

“However, there is a code present in the HTML file which shows that the ZIP file is in the OneDrive location. The ZIP file contains an MSI installer file. After extraction, it shows a fake error message upon execution of the MSI file. ” reads the analysis published by Cyble.

The MSI installer displays a fake error message upon execution while installing a DLL file (“main.dll”) in the background.

The ‘main.dll’ acts as a loader and downloads the actual Matanbuchus DLL from the C&C server. The DLL also establishes persistence by means of a scheduled task.

“Threat Actors use various techniques to deploy their malicious payloads into the victim’s system. In this case, we observed the TAs used Matanbuchus malware loader to deliver Cobalt Strike Beacons. ” concludes Cyble.

The report also includes MITER ATT & CK® Techniques and Indicators of Compromise.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs hacking, Matanbuchus)




Source

More from author

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Related posts

Advertismentspot_img

Latest posts

Multiple Vulnerabilities Discovered in Device42 Asset Management Appliance

A series of vulnerabilities on the popular asset management platform Device42 could be exploited to give attackers full root access to the system, according...

Top 5 best backup practices

Give yourself peace of mind by implementing a new backup strategy with our tips....

Indian Power Sector targeted with latest LockBit 3.0 variant

Estimated reading time: 5 minutesAfter the infamous Conti ransomware group was disbanded, its former members began to target the energy and power sectors...

Want to stay up to date with the latest news?

We would love to hear from you! Please fill in your details and we will stay in touch. It's that simple!