BelialDemon__2024__TLP-CLEAR-Matanbuchus-Co-Code-Emulation-and-Cybercrime-Infrastructure-Discovery-1.pdf

This report documents active malspam and Google Ads campaigns distributing the Matanbuchus loader and SocGholish redirectors, provides detailed static and dynamic code analysis (string decryption via emulation, API hashing, anti-debug techniques), maps C2/infrastructure hosted on apparent Russian bulletproof autonomous systems (AS198953, AS57523, AS216234), links activity to criminal affiliates (TA577 / Black Basta) and provides IOCs and detection recommendations to anticipate and mitigate further campaigns.