Marcher
Description
(ZScaler) Upon infection, Marcher would inspect the victim’s device and send a list of all installed apps to its command and control (C&C) server. If the malware found any German financial apps installed in the device, it would show a fake page asking for credentials of that particular institution. Unaware that the login page is a fake, the victim would provide their credentials where they would then be sent to the malware’s C&C. The malware would also show a fake Google Play payment page if the infected device did not have any German financial firm apps.
Names
| Name |
|---|
| Marcher |
Category
Malware
Type
- Banking trojan
- Credential stealer
Information
- https://www.zscaler.de/blogs/research/android-marcher-continuously-evolving-mobile-malware
- https://www.clientsidedetection.com/marcher.html
- https://www.clientsidedetection.com/exobot_v2_update___staying_ahead_of_the_competition.html
Mitre Attack
Malpedia
Alienvault Otx
Other Information
Uuid
7edce969-8cb1-410a-abb1-1612803b3e35
Last Card Change
2022-12-30