Marcher
Marcher is an Android banking trojan and password-stealing malware family. The provided content explicitly describes victims on Android devices being redirected to a download page for the Marcher Banking Trojan, and refers to Marcher as an Android banking trojan/password stealer. Marcher is also listed among malware families hosted or distributed through the Avalanche criminal infrastructure, a large fast-flux/double-fast-flux platform used for phishing, malware distribution, spam, and money mule schemes. Avalanche-linked campaigns were associated with credential theft and online banking fraud, and Marcher was one of roughly 20 malware families tied to that infrastructure. Additional reporting in the content links domains registered with the same email address used in a 2018 Japanese-themed phishing infrastructure to earlier February-March 2018 attacks involving Marcher. High-confidence details in the content therefore support that Marcher targets Android devices, is used for banking credential and password theft, and has been observed in financially motivated criminal campaigns and infrastructure associated with large-scale malware distribution. No specific Marcher-exclusive IOCs are directly provided beyond those infrastructure associations.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...Android devices are redirected to a download page for the Marcher Banking Trojan.
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniquesThe criminal groups have been using the Avalanche infrastructure since 2009 for conducting malware, phishing and spam activities. They sent more than 1 million e-mails with damaging attachments or links every week to unsuspecting victims.
They sent more than 1 million e-mails with damaging attachments or links every week to unsuspecting victims.
They sent more than 1 million e-mails with damaging attachments or links every week to unsuspecting victims.
Credential Access
2 techniquesMillions of private and business computer systems were also infected with malware, enabling the criminals operating the network to harvest bank and e-mail passwords.
Victims may have had their sensitive personal information stolen (e.g., user account credentials).
Command and Control
1 techniqueSinkholing is an action whereby traffic between infected computers and a criminal infrastructure is redirected to servers controlled by law enforcement authorities... infected computers can no longer reach the criminal command and control computer systems and so criminals can no longer control the infected computers.
IOCs tracked for this family
9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android banking trojan referenced as part of TA2727-associated activity set.
Android banking trojan referenced as a TA2727 payload delivered via Keitaro TDS traffic flows discussed alongside SocGholish delivery chains.
Android banking trojan / password-stealing malware linked in the content to related attacker-registered domains used earlier in 2018.
A malware family distributed through Avalanche; known in context here as part of credential and financial theft operations.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.