TF-MAL-apk.marcher
📛 Threat Title
Malware family: Marcher
Description
ThreatFox malware family `apk.marcher`. Printable name: Marcher. Aliases: ExoBot.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
apk.marcher
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.marcher
IOC database
- Type
- domain
- Value
apk.marcher- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-apk.marcher
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.marcher
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:cybernews.com
The FBI warns of a surge in ATM jackpotting attacks, with more than 700 incidents in 2025 alone. Hackers use Ploutus malware to force machines to dispense cash.
-
web:windowsforum.com
Microsoft's March cumulative update for Windows 11, KB5079473 (released March 10, 2026), is rolling out with a familiar mix of new features and security fixes — but a growing number of users now say the patch is also triggering severe instability on some machines, including hard freezes...
-
web:www.bitdefender.com
According to the advisory (FLASH-20260219-001), cybercriminals are increasingly deploying sophisticated malware — particularly variants of the Ploutus family — to force Automated Teller Machines (ATMs) to dispense cash without any legitimate transaction or bank authorization.
-
web:www.breachsense.com
Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.
-
web:www.bsi.bund.de
Name of Malware : Marcher Type of Malware : Banking Trojan Affected Operating Systems: Android Affected Device Types: Mobile phones, smartphones Impact: medium What is Marcher ? Marcher is a banking trojan for Android devices. Banking trojans intercept communication with your bank to access your PINs and TANs. They can therefore cause significant financial damage. In the case of Marcher , text ...
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.itfunk.org
Marcher is a dangerous banking trojan capable of stealing sensitive financial information and compromising Android devices. Its advanced persistence techniques and ability to perform overlay attacks make it a severe threat to users.
-
web:www.pcrisk.com
What kind of malware is Marcher ? Marcher is a banking trojan targeting Android devices. This malware is multi-functional and its primary goal to acquire banking and other finance-related information. Marcher has been around since at least 2013 and has undergone changes throughout the years. Marcher malware overview Upon installation, Marcher requests a variety of permissions - many of which ...
-
web:www.proofpoint.com
However, if a user was on an Android device, they would be given the same fake update redirect and download instructions, but the payload would be the Marcher banking trojan. Marcher is an old banking trojan that has targeted Android devices since 2013. Fake update on Android delivering Marcher .
-
web:www.rivitmedia.com
Marcher Malware Overview Marcher is a highly sophisticated banking Trojan that primarily targets Android users. Once installed, the malware requests extensive permissions, including device administrator rights, which allow it to modify system settings and ensure persistence.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.