Marcher is a notorious banking trojan that has been targeting Android users since at least 2013. Over the years, it has evolved into a highly sophisticated and multi-functional malware that primarily focuses on stealing banking and financial information. It achieves this by overlaying legitimate applications with fake login screens to phish credentials, intercepting SMS messages to steal One-Time Passwords (OTPs) and Two-Factor Authentication (2FA) codes, and manipulating system settings to ensure persistence.
Marcher Malware Overview
Marcher operates stealthily and is known for its ability to bypass security measures. Below is a detailed table summarizing key aspects of this malware:
| Category | Details |
|---|---|
| Threat Name | Marcher |
| Threat Type | Banking Trojan, Android Malware |
| Detection Names | Avast-Mobile (APK:RepMalware [Trj]), ESET-NOD32 (Multiple Detections), Fortinet (Android/Agent.FRJ!tr), Ikarus (Trojan-Dropper.AndroidOS.Agent), Kaspersky (HEUR:Trojan-Dropper.AndroidOS.Hqwar.df) |
| Symptoms of Infection | – Slow device performance – Unexpected system setting modifications – Unfamiliar apps installed – Increased data and battery usage – High background network activity |
| Distribution Methods | – Fake software updates – Malicious email attachments – Fraudulent advertisements – Social engineering tactics – Deceptive applications from third-party sources |
| Damage | – Stolen personal data (banking credentials, logins, passwords) – Compromised financial accounts – Identity theft – Unwanted charges due to SMS/call fraud – Drained device battery and slow performance |
| Danger Level | Severe – High risk of financial loss and data theft |
How Does Marcher Work?
Upon installation, Marcher requests excessive permissions, many of which are not typical for regular Android applications. The malware’s most alarming request is to function as a device administrator, which allows it to modify system settings, access sensitive data, and execute malicious activities without user consent.
Key Features of Marcher
- Persistence Mechanism – Marcher ensures that it starts automatically every time the device is rebooted, making it difficult to remove.
- Device Control Capabilities – It can change system settings, prevent the device from sleeping, lock the screen, and even block notifications.
- Network and Storage Access – The trojan can connect to and disconnect from Wi-Fi networks, access external storage (SD cards), and modify or delete files.
- SMS and Call Interception – Marcher can read, create, and send SMS messages, allowing it to steal OTPs and MFA codes used for financial transactions.
- Overlay Attack Technique – It overlays legitimate banking or financial apps with fake login pages, tricking users into entering their credentials.
- Data Collection – It gathers sensitive data such as geolocation, contact lists, and device information.
How Marcher Infects Android Devices
Cybercriminals use various deceptive techniques to spread Marcher. Some of the most common infection methods include:
- Fake Software Updates: Marcher is often disguised as a legitimate update for Adobe Flash Player, Google Play Store, or other popular applications.
- Malicious Email Attachments: Users may receive phishing emails with attachments containing Marcher malware.
- Infected Ads (Malvertising): Fraudulent online ads can redirect users to malicious websites that download Marcher onto their devices.
- Social Engineering Scams: Attackers use fake promotions, giveaways, and surveys to trick users into downloading the trojan.
- Third-Party App Stores: Apps downloaded from unofficial marketplaces are more likely to contain malware like Marcher.
How to Remove Marcher from an Infected Device
Removing Marcher can be challenging due to its persistence. Follow these steps carefully:
Step 1: Boot the Device into Safe Mode
- Press and hold the Power button.
- Tap and hold Power Off until the option to reboot into Safe Mode appears.
- Select OK to enter Safe Mode (this disables third-party apps).
Step 2: Remove Device Administrator Privileges
- Go to Settings > Security > Device Administrators.
- Find the suspicious app and Deactivate it.
- If the option is grayed out, first try force-stopping the app from Settings > Apps.
Step 3: Uninstall Suspicious Applications
- Open Settings > Apps.
- Look for unknown or recently installed apps.
- Select the app and tap Uninstall.
- If uninstallation is blocked, go back to Device Administrators and disable its admin rights.
Step 4: Clear Cache and Temporary Files
- Navigate to Settings > Storage.
- Tap Cached Data and clear all stored cache.
- Also, clear App Data for any suspicious applications.
Step 5: Reset Browser Settings
- Open Settings > Apps > Your Browser.
- Select Storage > Clear Cache & Data.
- Check if any unknown Homepage or Search Engine settings have been changed.
Step 6: Check for Unusual Permissions
- Open Settings > Apps & Notifications.
- Review permissions for suspicious apps.
- Disable unnecessary access (e.g., SMS, Contacts, Storage).
Step 7: Restart the Device and Monitor Activity
After completing the removal process, restart your device and check for any unusual behavior. If issues persist, consider backing up important data and performing a Factory Reset (Settings > System > Reset > Factory Data Reset).
How to Prevent Marcher Infections
To protect your Android device from malware like Marcher, follow these best practices:
- Avoid Downloading Apps from Unknown Sources
- Always use Google Play Store for downloading apps.
- Disable “Install unknown apps” in Settings.
- Be Cautious of App Permissions
- Never grant unnecessary permissions.
- Avoid apps requesting Device Administrator access.
- Enable Google Play Protect: Go to Google Play Store > Play Protect > Enable scanning.
- Keep Your Android System and Apps Updated
- Install security patches promptly.
- Use only official updates from device manufacturers.
- Beware of Phishing Emails and Messages
- Do not click on suspicious links.
- Verify senders before opening attachments.
- Use Strong Authentication for Banking Apps
- Enable 2FA with a separate authenticator app instead of SMS.
- Use biometrics (fingerprint or facial recognition).
- Regularly Monitor Your Device Activity
- Check data and battery usage for abnormalities.
- Review app permissions periodically.
Conclusion
Marcher is a dangerous banking trojan capable of stealing sensitive financial information and compromising Android devices. Its advanced persistence techniques and ability to perform overlay attacks make it a severe threat to users. By following the removal guide and implementing strong preventive measures, users can safeguard their devices and personal data from this malware.
