Matanbuchus Malware Downloader Evading AV Detections by Changing Components

Matanbuchus has reemerged using deceptive MSI installers as loaders to deploy a modular downloader that contacts C2 (e.g., https://nady.io/check/robot.aspx) to retrieve further payloads, including ransomware; operators frequently change code, obfuscation, and MSI structures to evade antivirus and ML detections, so defenders should monitor MSI execution, unexpected spawned processes, and suspicious outbound connections.