MATCHBOIL Malware Adds Sandbox Checks, .NET Reactor Obfuscation and Persistent C2

MATCHBOIL’s evolution from a basic C# downloader into a more evasive implant supporting recurring command-and-control communication.

Operated by UAC-0099, the malware now incorporates sandbox checks, commercial .NET obfuscation , deceptive interfaces, and revised persistence mechanisms, reflecting sustained development across samples spanning April 2024 through April 2026.

Compilation timestamps suggest earlier development, although timestamps alone do not establish deployment dates.

Observed infections affected Ukrainian transportation companies, a manufacturer, and an energy-sector organization.

UAC-0099 targets Ukrainian government organizations, financial institutions, and media. ESET assesses its alignment with Russian interests with medium confidence and notes that it can provide initial access for Sandworm.

The group also deploys LONEPAGE, a separate PowerShell downloader.

The downloader checks its installation location and collects machine identifiers, including processor information and BIOS serial numbers, to identify victims during C2 exchanges.

Its delivery protocol uses three HTTPS requests. The first retrieves a numeric value subsequently supplied through a custom HTTP header.

The second returns HTML containing a hexadecimal-encoded payload, which MATCHBOIL extracts using regular expressions and decodes into executable bytes. The third retrieves a string that can serve as configuration.

ESET’s investigation extends MATCHBOIL’s suspected development history beyond its first public documentation by CERT-UA in August 2025.

ESET Researchers said that , MATCHBOIL typically arrives through spearphishing links that deliver archives containing VBScript. Infection requires the recipient to execute the script, which downloads and launches the malware.

The downloaded executable is usually MATCHWOK, a C# backdoor associated exclusively with UAC-0099 in ESET’s reporting.

MATCHBOIL establishes persistence for that payload through scheduled tasks or registry entries; persistence for the downloader itself is handled separately by its delivery script or loader.

Early samples concealed class and method names with unprintable Unicode characters and encrypted strings using XOR operations and bitwise shifts.

Those later variants inspect Windows System event ID 6013, parsing English and Russian uptime messages.

One such change is an adjustment to the check of whether MATCHBOIL should run its malicious code: the operators have added the argument ‑plans that is executed along with the one, ‑auto.

MATCHBOIL treats the environment as suitable when it finds at least three events reporting uptime of 7,200 seconds or longer.

It also checks Debugger.IsAttached before starting a timer that executes C2 logic every two minutes.

This replaces the original one-shot delivery model with recurring retrieval, enabling subsequent download attempts and access to updated payloads.

Payload persistence also shifted: late-2025 samples created the UpdateCheckers\DailyPlanner scheduled task, configured to run every seven minutes.

Execution arguments separate malicious activity from decoy interfaces. Variants used -auto , later supplemented by -plans , while another adopted -renew .

Without the expected argument, users saw a daily planner or text- utility instead.

The April 2026 variant, also described by CERT-UA as MATCHBOIL.V2, packages the downloader as a DLL executed by a custom C# loader.

It adds an operating-system installation-age check and installs its payload as SMTPClientApplication.exe under %LOCALAPPDATA%\SMTPClient , using the MailClient\Checker scheduled task for persistence.

ESET reports C2 infrastructure hosted on virtual private servers and concealed behind Cloudflare , with Let’s Encrypt certificates.

Published indicators include virtualdailyplanner[.]pro , telemetry-conf[.]com , and flycloud-service[.]com .

These network indicators, recurring HTTPS activity, unexpected scheduled tasks, and script-driven loader execution provide concrete investigation pivots across the documented variants.

The changes show an emphasis on resisting automated analysis while maintaining payload delivery rather than replacing the downloader’s core operational purpose.

Note: IP addresses and domains are intentionally defanged (e.g., [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC .

Artificial Intelligence

Cyber security Course

Cyber Security Resources

Cybersecurity

Information Gathering

Information Security Risks

Anthropic Launches Cyber Mission to Protect Critical Infrastructure and Open-Source Software With Claude AI

Critical Citrix NetScaler Vulnerability Allows Remote Code Execution Attacks – CVSS 9.5

Microsoft Pushes Enterprises to Test Post-Quantum Certificates Before Large-Scale Migration

Microsoft Teams to Introduce Deepfake Detection to Identify AI-Generated Audio and Video in Meetings

Critical Sungrow Authentication Bypass Flaw Lets Hackers Take Control of Solar Power Plants

FBI Warns Chinese Hackers Use Automated Tools and Botnets to Steal Sensitive Data