Highly Flexible Marap Malware Enters the Financial Scene
A new downloader, which has been spotted in an array of recent email campaigns, uses anti-analysis techniques and calls in a system fingerprinting module.
A newly discovered downloader malware has been discovered as part of a new campaign primarily targeting financial institutions.
Researchers at Proofpoint said today that the downloader – dubbed “Marap” after its command-and-control phone-home parameter, “param,” spelled backwards – is notable for its focused functionality and modular nature, as well as its ability to perform reconnaissance through a systems-fingerprinting module.
“As defenses become more adept at catching commodity malware, threat actors and malware authors continue to explore new approaches to increase effectiveness and decrease the footprint and inherent ‘noisiness’ of the malware they distribute,” researchers said in Thursday’s post about the new malware.
On August 10, researchers began to notice several large email campaigns consisting of “millions of messages” leading to the same Marap malware payload.
The emails contained a variety of attachment types, including Microsoft Excel Web Query (“.iqy”) files, password-protected ZIP archives containing “.iqy” files, PDF documents with embedded “.iqy” files and Microsoft Word documents containing macros.
Many of the campaigns would purport to be from the sales department, important documents from a major unnamed bank or invoices from a random display name (such as “netadmin@[random domain]”).
The email attachments contain malicious macros for executing the Marap malware, which is written in C and contains a few notable anti-analysis features, researchers said.
One of these features is API-hashing, a commonly used process in malware to prevent analysts and automated tools from determining the code’s purpose. The process means that most of the Windows API function calls are resolved at runtime using a hashing algorithm, which is this case appears to be custom to Marap, said researchers.
Secondly, the malware uses timing checks at the beginning of important functions, which can hinder debugging and sandboxing. “If the calculated sleep time is too short, the malware exits,” the researchers explained.
Finally, the malware compares the system’s MAC address to a list of virtual machine vendors – and if a virtual machine is detected and a configuration flag is set, the malware may also exit, researchers said.
Marap uses HTTP for its C&C communication (although first it tries a number of legitimate WinHTTP functions to determine whether it needs to use a proxy, and if so, what proxy to use).
After command execution, a response message can be sent back to the C&C, which includes the bot ID, command, command ID, flag controlling response type, command status code and response data.
Marap is modular and flexible, enabling bad actors to download other modules and payloads. The most notable observed add-on was a systems-fingerprinting module being sent over from the C&C — which is a DLL module — to gather and send back an array of information to the server.
That information includes username, domain name, hostname, IP address, language, country, Windows version, anti-virus software detected and a list of Microsoft .ost files.
Marap is indicative of malware becoming more flexible and adopting new tactics to help bad actors evade analysis and add new capabilities, researchers at Proofpoint said: “This new downloader… points to a growing trend of small, versatile malware that give actors flexibility to launch future attacks and identify systems of interest that may lend themselves to more significant compromise.”
Source: threatpost

Latest Jobs
-
- Enterprise Business Development Director
- London
- Up to £80,000 + Uncapped OTE
-
Our client, a Global Managed Service Provider, is seeking an Enterprise Business Development Director who will be responsible for scoping, identifying, creating and driving revenue growth across Europe and Asia at C level in the enterprise market. The Enterprise Business Development Director will need: Experienced in selling high value (multimillion) Managed Services and SDWAN to large enterprise parties· Have the ability to scope, identify and sell high value and complex managed solutions Extensive experience of commercial principles and contract negotiations with new global clients. Consistency of tenure in current and recent job roles Managing presentations, negotiations, and responsible for development/nurturing of the client relationship. Reference Number: BD7371
-
- Technical Design Authority (Telecoms, SDWAN, IOT, WAN, Hosted Services)
- Germany
- Up to €90,000 plus car, bonus and benefits
-
Location: Frankfurt Technical design Authority is required to help lead a number of key client Migrations projects for this tier 1 Telecom company, the main role for the TDA is helping customers migrate to new services, with a focusing on hosting (AWS, Azure) SWWAN and IOT. You will be responsible for: Post sales design documentation, implementation and migration of complex solutions for managed enterprise customers. Complex solutions consist of multi-product services. The TDA’s role is to ensure that these services interoperate and integrate into the customer environment. Such products consist of but not limited to MPLS, Ethernet, IPSec VPN’s, VoIP, Video Conferencing, Wireless, Internet, Private DSL, WAN Optimization, Managed Security Services, Managed Hosting, SDWAN and Complex Migration Planning. The TDA will own the technical delivery of customer solutions and will be the technical interface between the customer, product teams and project management during service delivery. Close engagement with pre-sales, technically validating solutions proposed are deliverable and all technical aspects are clearly defined prior to contract signature. The TDA accepts technical ownership of the solution at the point of contract signature. Lead customer facing technical workshops requiring excellent communication with the ability to articulate technical concepts clearly to all levels of competency. Providing support to 3rd line teams for OEM and design related faults. You will need to be at CCIE level (ideally CCIE R&S or SP ) with strong low level design and deployment skills, comfortable in front of customers and leading customer meeting. Fluent German is required. Knowledge in SDWAN and Hosted services would be advantageous. Reference: RA7302
-
- Big Data Architect
- Newbury
- £70,000 + Benefits
-
A Big Data Architect is required for a leading Google Cloud partner. The Big Data Architect will be responsible for advising external customers(FTSE100) on Big data storage and transformation requirements on the Google Cloud platform. You will get the chance to be at the forefront of technology, regularly involved with Google Alpha tests – You will be shaping the future of google tech. Experience required; Public Cloud Architecture – Ideally Google but will consider people with an Azure or AWS background who are looking to move into GCP. Experience with Big Enterprise Data – Set ups, Flows, Pipelines etc. Strong SQL understanding – DataBase, Data Residency. Candidates must be based and eligible to work in the UK without sponsorship as our client do not have the ability to sponsor. Reference Number: PG7347
-
- NetIQ Consultant (Contract)
- London
- £600 Per Day
-
A NetIQ Consultant is needed for a 6 month engagement in London. The NetIQ Consultant will be responsible for Designing, Configuring & Implementing Micro Focus Operations Centre & eDirectory Solutions. Required skills and experience Current experience with Micro Focus Operations Centre & eDirectory. SC Clearance is needed due to the nature of work. Reference Number: CH7363