Matanbuchus
- Malware type
- loader
- Family
- Malware family
- Last IoC activity
- 2026-07-22 00:32:47
- Profile updated
- 2026-07-07 13:00:11
Targeted industries: education-and-nonprofits technology-and-telecommunications
Targeted regions: country_code:us country_code:be
Context
According to PCrisk, Matanbuchus is a loader-type malicious program offered by its developers as Malware-as-a-Service (MaaS). This piece of software is designed to cause chain infections. Since it is used as a MaaS, both the malware it infiltrates into systems, and the attack reasons can vary - depending on the cyber criminals operating it. Matanbuchus has been observed being used in attacks against US universities and high schools, as well as a Belgian high-tech organization.
Detection coverage
- 2 YARA rules
Detection rules
- MALPEDIA_Win_Matanbuchus_Auto (yara-rule)
- RUSSIANPANDA_Win_Mal_Matanbuchus_Loader (yara-rule)
Reports & references
- Palo Alto Unit 42 — Matanbuchus Malware As A Service (report)
- proofpoint.com — Clipboard Compromise Powershell Self Pwn (report)
- recordedfuture.com — Graybravos Castleloader Activity Clusters Target Multiple Industries (report)
- intrinsec.com — Prospero Proton66 Tracing Uncovering The Links Between Bulletproof Networks (report)
- intrinsec.com — Tlp Clear Matanbuchus Co Code Emulation And Cybercrime Infrastructure Discovery 1 (report)
- huntress.com — Clickfix Matanbuchus Astarionrat Analysis (report)
- r136a1.info — Introduction Of A Pe File Extractor For Various Situations (report)
- isc.sans.edu — 28752 (report)
- blog.cyble.com — Matanbuchus Loader Resurfaces (report)
- cybereason.com — Threat Analysis Msi Masquerading As Software Installer (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Matanbuchus (report)
- cyberark.com — Inside Matanbuchus A Quirky Loader (report)
- 0ffset.net — Matanbuchus Loader Analysis (report)
- research.openanalysis.net — Matanbuchus Triage (report)
- medium.com — A Deal With The Devil Analysis Of A Recent Matanbuchus Sample 3Ce991951D6A (report)
- blog.cyber5w.com — Matanbuchus Loader Analysis (report)
- embeeresearch.io — Tls Certificates For Threat Intel Dns (report)