Loading malware…
Marap is a modular downloader written in C that emerged in 2018 in large-scale email campaigns primarily targeting financial institutions. It has been associated with activity sharing characteristics with TA505 and appears to have been used as a first-stage payload to identify and further compromise selected victims. Marap is designed with a relatively small initial footprint and focused functionality centered on retrieving and executing additional modules or payloads after infection.
Observed delivery relied on malicious email attachments using multiple formats, including Excel Web Query files, password-protected archives containing those files, PDF documents embedding them, and macro-enabled Microsoft Word documents. Once executed, Marap establishes command-and-control over HTTP, performs basic victim identification, and can receive instructions to sleep, update its configuration, remove or update itself, save and execute payloads, manually load modules, load DLLs, and perform process hollowing or injection.
The malware incorporates several anti-analysis and defense-evasion features. It resolves Windows API functions dynamically through custom hashing, obfuscates strings with stack strings and XOR-based methods, stores configuration in encrypted form, and uses timing checks intended to frustrate debugging and sandboxing. It can also check MAC-address characteristics associated with virtualized environments and terminate based on configuration.
Marap has been observed delivering at least a fingerprinting module used for reconnaissance. That module collected host, network, locale, Outlook, and antivirus information, indicating that operators used Marap to triage infected systems and selectively deploy follow-on malware only to victims of interest. This behavior aligns with broader financially motivated intrusion patterns in which lightweight downloaders support flexible post-compromise operations while minimizing exposure during initial access.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
It is not unusual for the group to test new malware and never return to distributing it as they have with BackNet, Cobalt Strike, Marap, Dreamsmasher...
14 distinct techniques documented for this family, organized by ATT&CK tactic.
TA505 semble avoir procédé à la distribution de ses charges malveillantes uniquement par campagnes de courriels d’hameçonnage... L’unique vecteur d’infection pour l’instant connu du mode opératoire TA505 demeure le courriel d’hameçonnage incluant une pièce jointe ou un lien malveillant.
Most of the strings in the malware are obfuscated using one of three methods: Created on the stack (stack strings) Basic XOR encoding ... A slightly more involved XOR-based encoding.
Most of the Windows API function calls are resolved at runtime using a hashing algorithm. API hashing is common in malware to prevent analysts and automated tools from easily determining the code’s purpose.
4: Download URL, DES decrypt, create/hollow out a process (same executable as malware), and inject the downloaded MZ file
The second anti-analysis technique is the use of timing checks at the beginning of important functions... The last anti-analysis check compares the system’s MAC address to a list of virtual machine vendors. If a virtual machine is detected and a configuration flag is set, the malware may exit.
The module is a DLL written in C and gathers and sends the following system information to the C&C server: Username Domain name Hostname IP address Language Country Windows version ...
The module is a DLL written in C and gathers and sends the following system information to the C&C server: ... List of Microsoft Outlook .ost files
The second anti-analysis technique is the use of timing checks at the beginning of important functions... The last anti-analysis check compares the system’s MAC address to a list of virtual machine vendors. If a virtual machine is detected and a configuration flag is set, the malware may exit.
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware mentioned as a prior TA505-tested strain for background comparison.
Mentioned only as a comparative example of another downloader.
A modular downloader noted for a small footprint, stealthy infection, and reconnaissance focus.
Referenced only as a similar malware used for comparison regarding fingerprinting behavior.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.