Matanbuchus Loader Resurfaces

This report analyzes the Matanbuchus loader used in spam campaigns: victims receive a ZIP with an HTML file that drops an MSI which installs a DLL and VBS, performs anti-analysis checks, creates a scheduled task for persistence, fetches and XOR/RC4-decrypts a payload from C2, and ultimately deploys Cobalt Strike beacons; the report includes network indicators, file hashes, MITRE ATT&CK mappings, and mitigation recommendations.