MALWARE FAMILY

Matanbuchus

Internal ID: win.matanbuchus

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to PCrisk, Matanbuchus is a loader-type malicious program offered by its developers as Malware-as-a-Service (MaaS). This piece of software is designed to cause chain infections.

Since it is used as a MaaS, both the malware it infiltrates into systems, and the attack reasons can vary - depending on the cyber criminals operating it. Matanbuchus has been observed being used in attacks against US universities and high schools, as well as a Belgian high-tech organization.

Threat Analysis

Matanbuchus is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.cyber5w.com/matanbuchus-loader-analysis

→https://blog.cyble.com/2022/06/23/matanbuchus-loader-resurfaces/

→https://isc.sans.edu/diary/rss/28752

→https://medium.com/@DCSO_CyTec/a-deal-with-the-devil-analysis-of-a-recent-matanbuchus-sample-3ce991951d6a

→https://r136a1.info/2022/05/25/introduction-of-a-pe-file-extractor-for-various-situations/

→https://research.openanalysis.net/matanbuchus/loader/yara/triage/dumpulator/emulation/2022/06/19/matanbuchus-triage.html

→https://unit42.paloaltonetworks.com/matanbuchus-malware-as-a-service/

→https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/

→https://www.cyberark.com/resources/all-blog-posts/inside-matanbuchus-a-quirky-loader

→https://www.cybereason.com/blog/threat-analysis-msi-masquerading-as-software-installer

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.matanbuchus

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Matanbuchus