Skip to content
yararules.org
Menu

YARA · RussianPanda

RUSSIANPANDA_Win_Mal_Matanbuchus_Loader

Detects Matanbuchus 3.0 Loader component

MalwareMatanbuchusRussianPandaNo licence (all rights reserved)Compiles with YARA-X (with warnings)
Author
RussianPanda
Date
2025-02-15
Modified
2026-02-16
Score / Quality
75 / 81

What this rule detects

Detects Matanbuchus 3.0 Loader component

Associated malware family: Matanbuchus.

Targets: Windows PE.

It defines 5 patterns (0 text, 5 hex, 0 regex).

YARA-X says: warning[text_as_hex]: hex pattern could be written as text literal

Summary generated from the rule's metadata and condition.

Rule source

Rule text not reproduced

This rule comes from RussianPanda, which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:

View the rule on GitHubOpen the repository

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • ec29bcda7d42d812aebd2ee5be6e43256bcf6095b9fc36f92eec5d6475dd5e1f

Licence & attribution

Author: RussianPanda

Source repository: RussianPanda @ acb504b67b

Licence: No licence (all rights reserved) (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 3a7a22b3-a1aa-59d8-b947-99a2ea192a6b

Tags:FILE

Related rules