Skuggaheimar/Threat Intelligence/Matanbuchus Loader
MATANBUCHUS LOADER
MATANBUCHUS
MALWARE LOADER
ECRIME
Threat IntelligenceMalwareSeptember 23, 2025•15 min read

Matanbuchus Loader: Threat Intelligence Profile

MaaS loader

Scroll

Matanbuchus Loader (also known as Matanbuchus) is a malware loader active since 2021. MaaS loader. Key characteristics include: DLL loader, $2500/rental, BelialDemon developer, delivers Cobalt Strike/QakBot.

Overview & Background

MaaS loader. First identified in 2021, this threat is attributed to eCrime (MaaS).

Threat Assessment

Matanbuchus Loader remains an active threat. Organizations should implement detection rules and monitor for indicators associated with this malware loader.

Technical Analysis

Matanbuchus Loader employs the following capabilities and techniques:

MITRE ATT&CK Mapping

TacticTechniqueUsage
Initial AccessT1566.001 Phishing AttachmentCommon delivery vector
ExecutionT1204.002 Malicious FileUser-triggered execution
PersistenceT1547.001 Registry Run KeysAutostart persistence
Defense EvasionT1027 Obfuscated FilesPayload obfuscation
C2T1071.001 Web ProtocolsHTTP/HTTPS C2

Detection & Defense

Defend Against Matanbuchus Loader

Mjolnir Security provides detection and response capabilities against Matanbuchus Loader and similar threats.

Threat DetectionIncident ResponseThreat HuntingMDR ServicesThreat Intelligence
  • Proactive Threat Hunting Hunt for Matanbuchus Loader indicators and TTPs within your environment.
  • Threat Intelligence Monitor Matanbuchus Loader campaigns and infrastructure changes.
  • 24/7 Incident Response Rapid containment and forensic investigation. Call +1 833 403 5875.
Written by: Mjolnir Security  |  Published: September 23, 2025
Related Reports
Malware

Latrodectus: IcedID Successor

Read Report →
Malware

SystemBC: Ransomware Enabler

Read Report →