ClickFix Intrusion Delivers Matanbuchus 3.0 and Newly Identified AstarionRAT
Summary
Huntress analyzed a ClickFix intrusion that delivered Matanbuchus 3.0 and a previously unseen RAT, AstarionRAT. The operator created rogue accounts and moved laterally, but Defender blocked later RAT deployments before the operator reached its suspected objective.
Key points
- A ClickFix prompt led victims to run a silent MSI installer that delivered Matanbuchus 3.0 through Zillya antivirus DLL sideloading.
- Matanbuchus launched a layered chain involving another DLL sideload, an embedded Lua interpreter, and a reflective loader that executed AstarionRAT.
- AstarionRAT supports 24 commands, including credential theft, shell execution, a SOCKS5 proxy, port scanning, and reflective code loading; its C2 traffic was disguised as application telemetry.
- The operator returned about 17 hours later, created rogue administrator accounts, and used RDP and PsExec to move across a Windows Server and two domain controllers in under 40 minutes.
- Defender quarantined the RAT’s jli.dll on two hosts before deployment succeeded. The operator’s attempt to pivot to a primary domain controller failed.
- Huntress assessed with medium confidence that the suspected objective was ransomware deployment or data exfiltration; the operator was disrupted before reaching a final objective.
Article Details
- Attack Vectors
- ClickFix prompts instructed the victim to run a command that silently installed an MSI payload.
- The MSI used Zillya! Antivirus binaries to sideload the Matanbuchus 3.0 DLL.
- Matanbuchus downloaded a second-stage package that sideloaded a malicious jli.dll through java.exe, ultimately deploying AstarionRAT.
- The operator used PsExec and RDP for lateral movement, created rogue local administrator accounts, and attempted to deploy AstarionRAT on additional hosts.
- Defensive Notes
- Train users not to execute commands copied from unexpected prompts; consider disabling the Run dialog and configuring Windows Terminal to warn about pasted multi-line text.
- Monitor net user and net localgroup commands that create unfamiliar accounts or add them to local Administrators, especially when run through PsExec or remote services.
- Monitor PsExec execution from non-standard paths, including C:\ProgramData\USOShared\.
- Defender quarantined jli.dll on both targeted hosts before the attempted RAT deployments succeeded.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | www[.]ndibstersoft[.]com | AstarionRAT C2 hostname stored in the malware’s configuration. |
| IPV4 | 192[.]121[.]23[.]146 | IP address resolved by the malicious ClickFix delivery domain and associated with its delivery infrastructure. |
| SHA256 | 03c624d251e9143e1c8d90ba9b7fa1f2c5dc041507fd0955bdd4048a0967a829 | Hash of SySUpd, the XOR-encrypted Lua script used in the malware execution chain. |
| SHA256 | 68858d3cbc9b8abaed14e85fc9825bc4fffc54e8f36e96ddda09e853a47e3e31 | Hash of the malicious jli.dll stage-two loader. |
| SHA256 | 6ffae128e0dbf14c00e35d9ca17c9d6c81743d1fc5f8dd4272a03c66ecc1ad1f | Hash of SystemStatus.dll, identified as the Matanbuchus loader payload. |
| SHA256 | 8e54cd12591d67dfbe72e94c1bde6059e1cba157e6786aec63f8f9e3c71fb925 | Hash of the reflective PE loader that reconstructs the Stage 1 DLL and passes the final payload onward. |
| SHA256 | c31c8edbf94c85cc9bc46a5665c45a3556c48d5ad615c0a44e14e5406d80df12 | Hash of the Stage 1 payload that decrypts, decompresses, and maps the final payload into memory. |
| SHA256 | de81e2155d797ff729ed3112fd271aa2728e75fc71b023d0d9bb0f62663f33b3 | Hash of the encrypted shellcode payload delivered alongside the MSI. |
| SHA256 | ea378496135318ac5ad667a032fa4a9686add9d27fe4a7c549c937611b5099e5 | Hash listed for Updprofile.aspx, identified as the Matanbuchus core module. |
| SHA256 | eecc83add16f3d513a9701e9a646b1885014229ac6f86addd6b10afb64d1d2af | Hash listed for Beacon.exe, the final payload artifact associated with the AstarionRAT delivery chain. |
| URL | hxxp[:]//binclloudapp[.]com/466943 | ClickFix MSI delivery URL identified in the article as malicious. |
| URL | hxxps[:]//marle[.]io/check/updprofile.aspx | Hardcoded Matanbuchus C2 URL used to download the encrypted main module. |
MITRE ATT&CK
T1018 · Remote System DiscoveryThe operator used nltest /dclist: to enumerate domain controllers.T1021.001 · Remote Desktop ProtocolThe operator used RDP to access a Windows Server and later authenticated using the newly created DefaultService account.T1046 · Network Service DiscoveryAstarionRAT’s command set included network port-scanning capability.T1053.005 · Scheduled TaskAstarionRAT persistence was established with a scheduled task named Application Maintenance.T1059.003 · Windows Command ShellThe operator used cmd.exe commands, including a command to start the AppMgmt service.T1069.002 · Domain GroupsThe operator queried the Domain Admins group with net groups "Domain Admins" /domain.T1071.001 · Web ProtocolsAstarionRAT communicated with its C2 over HTTP, using GET beacons and POST responses while disguising requests as application telemetry.T1098.007 · Additional Local or Domain GroupsThe operator added the newly created DefaultService account to local Administrators groups.T1105 · Ingress Tool TransferMatanbuchus used an HTTPS GET request to download its main module from a hardcoded C2 URL.T1136.001 · Local AccountThe operator created the local account DefaultService on multiple hosts.T1204.004 · Malicious Copy and PasteClickFix prompts instructed victims to copy and run attacker-provided commands.T1562.001 · Disable or Modify ToolsThe operator set a Defender exclusion for C:\ProgramData\USOShared\ after Defender had detected and quarantined jli.dll.T1569.002 · Service ExecutionThe operator used PsExec to execute scripts and deploy files remotely on the Windows Server and domain controllers.T1574.002 · DLL Side-LoadingThe MSI and later stages used malicious DLLs loaded by legitimate Zillya! Antivirus binaries and java.exe.T1620 · Reflective Code LoadingAstarionRAT included a reflective code loader for executing operator-supplied payloads in memory; the delivery chain also used a reflective PE loader.
People
Threat Actors
Malware
AstarionRATIn the intrusion we responded to, Matanbuchus delivered a RAT we had never seen before, a fully featured, custom implant we have dubbed AstarionRAT.Matanbuchus 3.0The ClickFix infection delivered Matanbuchus 3.0, a premium Malware-as-a-Service (MaaS) loader that has been sold on Russian-speaking cybercrime forums since it was first advertised by a threat actor known as
Products
Defenderon the operator's playbook - rapid lateral movement to domain controllers, rogue account creation, and Defender exclusion staging, which closely mirrors patterns observed in pre-ransomware operations.Microsoft Windowsthe operator returned the next day, moved laterally across the network within 40 minutes, hitting a Windows Server and two domain controllers, using PsExec, rogue account creation, and Defender exclusions.