Highly Flexible Marap Malware Enters the Financial Scene
A new downloader, which has been spotted in an array of recent email campaigns, uses anti-analysis techniques and calls in a system fingerprinting module.
A newly discovered downloader malware has been discovered as part of a new campaign primarily targeting financial institutions.
Researchers at Proofpoint said today that the downloader – dubbed “Marap” after its command-and-control phone-home parameter, “param,” spelled backwards – is notable for its focused functionality and modular nature, as well as its ability to perform reconnaissance through a systems-fingerprinting module.
“As defenses become more adept at catching commodity malware, threat actors and malware authors continue to explore new approaches to increase effectiveness and decrease the footprint and inherent ‘noisiness’ of the malware they distribute,” researchers said in Thursday’s post about the new malware.
On August 10, researchers began to notice several large email campaigns consisting of “millions of messages” leading to the same Marap malware payload.
The emails contained a variety of attachment types, including Microsoft Excel Web Query (“.iqy”) files, password-protected ZIP archives containing “.iqy” files, PDF documents with embedded “.iqy” files and Microsoft Word documents containing macros.
Many of the campaigns would purport to be from the sales department, important documents from a major unnamed bank or invoices from a random display name (such as “netadmin@[random domain]”).
The email attachments contain malicious macros for executing the Marap malware, which is written in C and contains a few notable anti-analysis features, researchers said.
One of these features is API-hashing, a commonly used process in malware to prevent analysts and automated tools from determining the code’s purpose. The process means that most of the Windows API function calls are resolved at runtime using a hashing algorithm, which is this case appears to be custom to Marap, said researchers.
Secondly, the malware uses timing checks at the beginning of important functions, which can hinder debugging and sandboxing. “If the calculated sleep time is too short, the malware exits,” the researchers explained.
Finally, the malware compares the system’s MAC address to a list of virtual machine vendors – and if a virtual machine is detected and a configuration flag is set, the malware may also exit, researchers said.
Marap uses HTTP for its C&C communication (although first it tries a number of legitimate WinHTTP functions to determine whether it needs to use a proxy, and if so, what proxy to use).
After command execution, a response message can be sent back to the C&C, which includes the bot ID, command, command ID, flag controlling response type, command status code and response data.
Marap is modular and flexible, enabling bad actors to download other modules and payloads. The most notable observed add-on was a systems-fingerprinting module being sent over from the C&C — which is a DLL module — to gather and send back an array of information to the server.
That information includes username, domain name, hostname, IP address, language, country, Windows version, anti-virus software detected and a list of Microsoft .ost files.
Marap is indicative of malware becoming more flexible and adopting new tactics to help bad actors evade analysis and add new capabilities, researchers at Proofpoint said: “This new downloader… points to a growing trend of small, versatile malware that give actors flexibility to launch future attacks and identify systems of interest that may lend themselves to more significant compromise.”
- Healthcare Business Development Manager
- Up to £60,000 Base + UNCAPPED Earnings
Healthcare Business Development Manager We are currently working with a multi-vendor IT solutions provider who are looking for a Business Development Manager who will be responsible for selling into the Healthcare Industry in a new business focussed position. The Healthcare Business Development Manager will have Current/Recent experience working for an IT managed services business/solutions provider. Experience delivering £150,000+ GP a year Current/Recent experience winning new healthcare accounts (all accounts won are kept) Flexible working is provided and also uncapped earnings. Apply for more information or call Peter Georgiou on 02086634030. Unfortunately, our client are unable to provide sponsorship so candidates must be UK based (commutable to London). Ref PG7577
- Cyber Incident Response specialist
- Up to £75,000 Base
Cyber Incident Response specialist is needed to join a global consultancy whose cyber business unit are continuing to their investment in the growth of their team. The Cyber Incident Response specialist role is client-facing that will join an award-winning team that deliver varied, interesting and often challenging work to a wide range of prestigious clients. The Cyber Senior Incident Response MUST have current experience taking a client through the complete IR / triage process and have a blend of both technical and commercial (identifying and developing new business opportunities within a client) Proactive Incident response, forensics and Ediscovery experience is a MUST. An individual must be London commutable and happy to travel, often internationally. Key attributes should also include; stakeholder engagement, mentoring of team members, a collaborative working style. Technical experience must include; demonstrable experience within an cyber incident response, Forensic, cyber etc. Additional certifications could / should include GIAC certified (Intrusion analyst, incident handler, forensic handler) Any of the following are very desirable also CREST Certified Network Intrusion Analyst (CCNIA) CREST Certified Host Intrusion Analyst (CCHIA) CREST Certified Malware Reverse Engineer (CCMRE) CREST Practitioner Intrusion Analyst (CPIA) Career development and the opportunity to influence, apply today for more information or call Chris Holt on 07884666351 or 02086634030 or email email@example.com Unfortunately, our client are unable to provide sponsorship for this opportunity. Candidates must be UK based. Ref: CH7578
- Sales Engineer (Telecoms, Ethernet, SDH, MPLS, IP)
- Up to €75,000 + Commission
Sales Engineer / Presales Consultant is needed for this Global Tier 1 carrier. You will be working with Enterprise customers helping to design solutions that solve your their business needs. You will be responsible for working alongside sales providing presales technical consultancy around my client's solutions base. You will be responsible for providing support for new business opportunities in terms of responding to RFIs & RFPs, understanding customer network requirements, high-level network architecture & design (including supplier selection on a global basis) and technical handover to network implementation teams. This is a great opportunity to join a global player who are growing their France based teams. You will require a successful track record in the telecommunications arena ideally from a global tier 1 ISP or network provider, with a demonstrable track record in designing complex enterprise solutions. A Sales Engineer needs to be technically astute and has had experience in the design, presentation, and implementation of Wide Area Networks (WAN). They need to understand a range of Layer 1, 2, and 3 technologies (Ethernet, SDH, MPLS, IP, etc) and build a solution based on the best technology to meet a customer’s requirements. In addition, they should have an understanding and experience in supplementary telecommunications services such as VoIP, Video Conferencing, Cisco and Riverbed hardware, and Security If you have any questions about this role, give us a call on 0044208 663 4030 or contact/send your CV to firstname.lastname@example.org Ref: RA7275
- Partner Manager (Network and UCC Services)
- Up to €100,000 plus €60,000 OTE, car allowance and benefits
We are looking for an experienced Partner Manager / Channel Manager to work for a global service provider to sell their Global SIP and Network Services to Enterprises and corporates through the partner market. This is a hunter role, and looking for an experienced salesperson who has knowledge of selling to and through the SI, Cisco and Microsoft Resellers. You will be responsible for Own and formulate a Sales and execution plan to get to quarterly targets Generate Leads from the partners Work with the Partner salesperson to help close deals. Acquire new partners and Deliver Quarterly numbers through the partners Work with Partner Marketing to create and run joint Partner plans/events to drive sales You will need to have experience in selling at least one of these services, global SIP, UCC and SD-WAN into and through the channel of, European Sis, Cisco or Microsoft resellers. Hunters who can identify key decision-makers in the targeted accounts Should be credible for partner to trust the person with leads and opportunities Drive to work through leads to closure along with the partner salesperson Ref: RA7277