MATCHBOIL Malware Adds Sandbox Checks, .NET Reactor Obfuscation and Persistent C2

ESET’s analysis documents MATCHBOIL’s progression from a basic C# downloader into an evasive implant used by UAC-0099 to deliver MATCHWOK backdoors, adding sandbox/anti-debug checks, commercial .NET obfuscation, recurring HTTPS-based C2 retrieval, and scheduled-task/registry persistence; infections were observed against Ukrainian transport, manufacturing, and energy targets and the report includes technical TTPs and IOCs (file hashes, domains) for detection and response.