Marcher
MITRE ATT&CK: S0317 View on attack.mitre.org
Aliases: ExoBot, Marcher
- Family
- Malware family
- Related IoCs
- 24 (23 malicious)
- Last IoC activity
- 2026-10-18 00:38:01
- Profile updated
- 2026-07-07 11:31:11
Context
Marcher is Android malware that is used for financial fraud.
Recent IoC activity
24 malicious indicators in Maltiverse are attributed to Marcher (S0317). The 20 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| hostname | trackgoogle.at | 2026-10-18 | 1 |
| hostname | sarahtame.at | 2026-10-18 | 1 |
| hostname | servercheck.online | 2026-10-18 | 1 |
| hostname | thhausgajk.com | 2026-10-18 | 1 |
| hostname | utabwbazuu.com | 2026-10-17 | 1 |
| hostname | checkdns.digital | 2026-10-13 | 1 |
| hostname | checkdnsplus.space | 2026-10-12 | 1 |
| hostname | fastcheckdns.xyz | 2026-10-10 | 1 |
| hostname | i-app4.online | 2026-10-10 | 1 |
| file sample | marcher_2017-01-29.apk | 2026-10-06 | 2 |
| hostname | plusdnscheck.website | 2026-10-05 | 1 |
| hostname | s222231232fdnsjds.top | 2026-10-05 | 1 |
| hostname | i-app5.online | 2026-10-05 | 1 |
| hostname | esappguide.com | 2026-10-04 | 1 |
| hostname | wqetwertwertwerxcvbxcv.at | 2026-10-04 | 1 |
| hostname | dnscheck.design | 2026-10-02 | 1 |
| hostname | ssnoways.info | 2026-09-22 | 1 |
| hostname | fastcheckdns.shop | 2026-09-17 | 1 |
| hostname | track-google.at | 2026-09-16 | 1 |
| hostname | fastcheck.digital | 2026-09-16 | 1 |
Reports & references
- Kaspersky — 96280 (report)
- malpedia.caad.fkie.fraunhofer.de — Apk.Marcher (report)
- zscaler.de — Android Marcher Continuously Evolving Mobile Malware (report)
- proofpoint.com — Update Fake Updates Two New Actors And New Mac Malware (report)
- clientsidedetection.com — Exobot V2 Update Staying Ahead Of The Competition (report)
- MITRE ATT&CK — S0317 (report)
- proofpoint.com — Credential Phishing And Android Banking Trojan Combine Austrian Mobile Attacks (report)