Free tools Windows power users keep installed
One-click scans. No signup required.
MATCHBOIL is a custom C# downloader that ESET attributes to UAC-0099. It retrieves and installs another payload—usually the C# espionage backdoor MATCHWOK in the samples ESET examined. The distinction is important: MATCHBOIL delivers the malware; MATCHWOK is typically the component used for spying.
What MATCHBOIL does—and what it installs
ESET describes MATCHBOIL as malware that downloads, installs, and persists a second-stage payload. In most of the samples it analyzed, that payload was MATCHWOK, a backdoor used for espionage. MATCHBOIL and MATCHWOK are therefore related but not interchangeable names.
As an Amazon Associate I earn from qualifying purchases.
ESET Research’s analysis covers samples compiled or observed between April 2024 and April 2026. ESET reports that CERT-UA first publicly documented MATCHBOIL in August 2025. Earlier sample timestamps point to possible development beginning in April 2024, but a compilation timestamp is not proof of when development or deployment began. ESET’s technical analysis explains the sample behavior and its limits.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How the infection chain works
1. A phishing link delivers a script
ESET describes spear-phishing emails containing malicious links. Following a link downloads an archive with a VBScript file. The documented chain requires the recipient to run that script manually; the script then downloads and executes MATCHBOIL. The initial link alone is not described as silently installing the downloader.
#1 Best Overall
2. MATCHBOIL contacts its command-and-control server
At startup, MATCHBOIL checks for an installation directory under %LOCALAPPDATA% and exits if that directory already exists. It collects identifiers including the computer’s CPUID and BIOS serial number, then makes three HTTPS requests to its command-and-control (C&C) server.
ESET says the second response contains HTML-like content with a hex-encoded payload. MATCHBOIL extracts and decodes that content before installing the payload. The third request returns a string that the malware saves alongside the installed payload; ESET says it may serve as configuration.
3. The payload and downloader establish persistence
Depending on the version, MATCHBOIL persists the installed executable using a Windows scheduled task or a registry value. The delivery script can also establish persistence for MATCHBOIL itself. These are separate parts of the chain: persistence for the downloader does not replace persistence for the payload.
How MATCHBOIL changed across analyzed versions
ESET’s samples show changes in communication, obfuscation, persistence, and attempts to avoid analysis. These findings describe the variants ESET examined, not a checklist shared by every MATCHBOIL sample.
Rank #3
| Behavior | Earlier samples | Later changes ESET observed |
|---|---|---|
| C&C communication | One-shot downloading behavior | Some versions attempt to contact C&C every two minutes |
| Obfuscation | Unicode symbol renaming and custom string encryption | Eziriz .NET Reactor in later samples |
| Persistence | Registry Run keys | Scheduled tasks in some versions; persistence varies |
| Analysis avoidance and presentation | Not described as a consistent early behavior | Late-2025 samples added environment checks and a decoy interface when launched manually |
Late-2025 samples checked Windows Event ID 6013 uptime logs. In the variants ESET describes, the system was treated as outside a sandbox when at least three uptime events showed 7,200 seconds (two hours) or more. The April 2026 sample also checked whether Windows had been installed at least ten days earlier. These thresholds apply to the specific variants ESET analyzed, not necessarily to other samples.
What is known about UAC-0099 and its targeting
ESET describes UAC-0099 as a cyberespionage group that has targeted Ukrainian government organizations, financial institutions, and media. Its telemetry also recorded MATCHBOIL samples at transportation companies in Ukraine in July and August 2025, a manufacturing company in December 2025, and an energy company in June 2026. These are ESET observations, not a complete victim list or a measure of how common infections are.
ESET assesses, with medium confidence, that UAC-0099 is aligned with Russian interests, based on its targeting. That is an attributed analytical assessment—not proof that the group is directed by the Russian state. ESET also says UAC-0099 may act as an initial access broker for Sandworm; “may” is important because this, too, is not stated as a certainty. The ESET report provides the attribution and confidence language.
Detection and response: what the sources establish
ESET lists sample names and SHA-1 hashes in its technical article and links to a repository with a more comprehensive set of indicators and samples. For operational hunting, use that repository rather than treating a short list of hashes as complete. File indicators and C&C infrastructure can change as malware evolves.
Best Value
ESET describes UAC-0099 infrastructure using VPS providers such as BitLaunch and Cloudflare to conceal C&C servers, with HTTP and HTTPS observed. Those infrastructure details are time-sensitive and should not be treated as a durable blocklist.
Trend Micro documents DDI Rule 5515, “Matchboil Downloader HTTP Request,” and advises customers to update Trend Micro products and scan a host exhibiting the behavior. This is guidance specific to that vendor’s products, not a general incident-response procedure. The sources cited here do not establish a universal consumer cleanup process.
What the reporting does—and does not—show
ESET’s reported victims were in Ukraine, but that describes the reach of its telemetry, not every possible infection. The available reporting also does not give a population-level victim count or independently verified infection rate. Likewise, the “Russia-aligned” description should remain attributed to ESET’s medium-confidence assessment rather than being presented as established state control.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The most useful distinction for understanding the threat is functional: MATCHBOIL is the downloader, while MATCHWOK is usually the espionage backdoor it installs in the samples ESET analyzed. The phishing link, manually run script, evolving downloader behavior, and qualified attribution each describe a different part of the picture.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
