Matanbuchus - AstarionRAT Secondary Payload Drop (T1105)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•1•0•2

Detects the Matanbuchus loader downloading and writing the AstarionRAT executable payload to disk in the AppData directory, specifically when initiated by rundll32.exe.