MATCHBOIL Malware Uses Sandbox Evasion and Strong Obfuscation to Deploy MATCHWOK Backdoor

ESET analyzed MATCHBOIL, a C# downloader used by UAC-0099 to fetch and maintain the MATCHWOK backdoor; the report documents spearphishing infection chains, persistence via registry/tasks, three-step HTTPS C2 retrieval of hex-encoded payloads, and evolution of obfuscation and sandbox-evasion techniques between 2024–2026, with victims observed mainly in Ukraine across transport, manufacturing, and energy sectors.