Highly Flexible Marap Malware Enters the Financial Scene
A new downloader, which has been spotted in an array of recent email campaigns, uses anti-analysis techniques and calls in a system fingerprinting module.
A newly discovered downloader malware has been discovered as part of a new campaign primarily targeting financial institutions.
Researchers at Proofpoint said today that the downloader – dubbed “Marap” after its command-and-control phone-home parameter, “param,” spelled backwards – is notable for its focused functionality and modular nature, as well as its ability to perform reconnaissance through a systems-fingerprinting module.
“As defenses become more adept at catching commodity malware, threat actors and malware authors continue to explore new approaches to increase effectiveness and decrease the footprint and inherent ‘noisiness’ of the malware they distribute,” researchers said in Thursday’s post about the new malware.
On August 10, researchers began to notice several large email campaigns consisting of “millions of messages” leading to the same Marap malware payload.
The emails contained a variety of attachment types, including Microsoft Excel Web Query (“.iqy”) files, password-protected ZIP archives containing “.iqy” files, PDF documents with embedded “.iqy” files and Microsoft Word documents containing macros.
Many of the campaigns would purport to be from the sales department, important documents from a major unnamed bank or invoices from a random display name (such as “netadmin@[random domain]”).
The email attachments contain malicious macros for executing the Marap malware, which is written in C and contains a few notable anti-analysis features, researchers said.
One of these features is API-hashing, a commonly used process in malware to prevent analysts and automated tools from determining the code’s purpose. The process means that most of the Windows API function calls are resolved at runtime using a hashing algorithm, which is this case appears to be custom to Marap, said researchers.
Secondly, the malware uses timing checks at the beginning of important functions, which can hinder debugging and sandboxing. “If the calculated sleep time is too short, the malware exits,” the researchers explained.
Finally, the malware compares the system’s MAC address to a list of virtual machine vendors – and if a virtual machine is detected and a configuration flag is set, the malware may also exit, researchers said.
Marap uses HTTP for its C&C communication (although first it tries a number of legitimate WinHTTP functions to determine whether it needs to use a proxy, and if so, what proxy to use).
After command execution, a response message can be sent back to the C&C, which includes the bot ID, command, command ID, flag controlling response type, command status code and response data.
Marap is modular and flexible, enabling bad actors to download other modules and payloads. The most notable observed add-on was a systems-fingerprinting module being sent over from the C&C — which is a DLL module — to gather and send back an array of information to the server.
That information includes username, domain name, hostname, IP address, language, country, Windows version, anti-virus software detected and a list of Microsoft .ost files.
Marap is indicative of malware becoming more flexible and adopting new tactics to help bad actors evade analysis and add new capabilities, researchers at Proofpoint said: “This new downloader… points to a growing trend of small, versatile malware that give actors flexibility to launch future attacks and identify systems of interest that may lend themselves to more significant compromise.”
- Cyber Incident Response Consultant, Italy
- Up to €60,000
Cyber Incident Response Consultant, Italy Up to €60,000 Cyber Incident Response Consultant is needed to join a global consultancy whose cyber business unit are continuing to their investment in the growth of their team. The Cyber Incident Response Consultant role is client facing that will join an award-winning team that deliver varied, interesting and often challenging work to a wide range of prestigious clients. The Cyber Incident Response Consultant MUST have current experience taking a client through the complete IR / triage process and have a blend of both technical and commercial (identifying and developing new business opportunities within a client) Proactive Incident response, forensics and eDiscovery experience is a MUST. The Cyber Incident Response Consultant must be happy to travel. Key attributes should also include; stakeholder engagement, mentoring of team members, a collaborative working style. Technical experience must include; demonstrable experience within an cyber incident response, Forensic, cyber etc. Additional certifications could / should include GIAC certified (Intrusion analyst, incident handler, forensic handler) Any of the following are very desirable also CREST Certified Network Intrusion Analyst (CCNIA) CREST Certified Host Intrusion Analyst (CCHIA) CREST Certified Malware Reverse Engineer (CCMRE) CREST Practitioner Intrusion Analyst (CPIA) Career development and the opportunity to influence, apply today for more information.
- Data Consultant
- Up to £90,000 Base
Data Consultant Location: London Salary: Up to £90,000 basic DD7692 A leading Google Cloud Platform (GCP) Provider who is looking for a Data Consultant, based in London. Experience with GCP or other similar platforms (AWS, AZURE etc), experience with GCP technologies as well as experience with Machine Learning, Data Mining and Data Analytics. The Data Consultant will be responsible for design solutions for customers and providing technical knowledge in customer meetings. Ideally, the Data Consultant will have experience transforming the way companies work by building company-centric solutions on the Google Cloud Platform or similar cloud platforms. Our client is a Premier Google Cloud Partner, offering an exciting opportunity to work with innovative technology whilst giving you the chance to grow and develop your career. You will have the opportunity to benefit from a number of training courses at several Google locations.
- Senior Delivery Consultant Emerging Technologies
Senior Delivery Consultant Emerging Technologies The Senior Delivery Consultant will work on pure retained executive search mandates in the emerging technology sector. The Senior Delivery Consultant will work closely with the practice lead to complete research and deliver the assignment to completion. This is a senior role with both client and candidate contact, although you will not have a fee generation target. A generous commission structure will exist linked to the successful delivery of assignments. Come and work for a business where the client is retained and you can focus 100% of your time and efforts headhunting the best talent out there in the market! Ref: AMSDC Salary: Dependant on Experience Location: Beckenham
- SOC Manager / Threat Hunting Service Lead, Cyber
- £85,000 +
REFCH7713 SOC Manager / Threat Hunting Service Lead, Cyber £85,000 + Bracknell SOC Manager / Threat Hunting service Lead needed- must be commutable to the Reading / Bracknell area. We are looking for a SOC Manager / Threat Hunting Service Lead to aid in building out a new SOC / Threat hunting (IR) service offering. An in-depth technical background is essential, experience across SOC SIEM/ Threat Hunting (IR) tools, processes, techniques, operational is a MUST. The role will include, but not limited to; Establishing the technical process, building operational capability, managing and hiring team, creation of policy/playbooks, fine turning of the go-to-market collateral etc. Apply today for more information or contact me directly on Chris.Holt@dclsearch.com or 07884666351 Cyber Security Jobs, Information Security Jobs, SOC Manager Jobs, SOC Jobs