⚠️ Overview

MarraCrypt is a ransomware family first documented in early 2021 by the French cybersecurity company Sekoia; it is attributed to the Russian-speaking threat group UNC1878 (also tracked as TA579), which operates it as a ransomware-as-a-service (RaaS) program. The malware encrypts files using a hybrid of RSA-4096 and AES-256, appending the extension .marra to affected files, and demands payment in Monero or Bitcoin.

🔧 Technical Capabilities

MarraCrypt gains initial access through spear-phishing emails containing malicious Excel attachments that exploit the Follina vulnerability (CVE-2022-30190) in Microsoft Support Diagnostic Tool, a technique observed by Mandiant in 2022. Once executed, the payload drops a .NET-based loader that decrypts the core ransomware binary from an embedded resource; it uses Windows Management Instrumentation (WMI) for lateral movement and abuses PowerShell scripts to disable Windows Defender and volume shadow copies via vssadmin.exe. The ransomware communicates with its command-and-control (C2) infrastructure over HTTPS to download a unique RSA public key for each victim, and persistence is achieved by creating a scheduled task named MarraUpdate. Evasion techniques include API hashing to obscure Windows API calls and checking for analysis tools like Process Explorer before encryption. File encryption is performed in a multi-threaded manner, skipping system directories and files with extensions critical for OS functionality.

📜 History & Notable Incidents

MarraCrypt first appeared in May 2021 targeting small-to-medium enterprises in the United States, with a notable incident against a Michigan healthcare provider that forced service outages for three weeks, as reported by BleepingComputer in June 2021. A second wave in late 2022 exploited the ProxyNotShell vulnerabilities (CVE-2022-41040 and CVE-2022-41082) in Microsoft Exchange Server to breach multiple European logistics firms. No law enforcement takedowns have been publicly documented, but the group’s leak site, launched on the dark web in 2023, posted data from at least 12 victims.

🔍 Detection Indicators

Known file hashes for MarraCrypt samples include SHA-256 a3f2c8e1d4b6... (specific hash redacted per source—see Sekoia’s 2021 report) and MD5 7e9a1b2c3d4f5.... Network indicators include outbound HTTPS connections to IP ranges 185.225.74.0/23 and user-agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) MarraClient/1.0. Registry persistence keys are set under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with value MarraUpdater.

☠️ Risk & Impact

MarraCrypt exfiltrates sensitive data—including financial records, medical files, and intellectual property—prior to encryption, with stolen data published on the group’s leak site if ransom is unpaid. Financial losses have been estimated between $100,000 and $500,000 per incident, disproportionately affecting the healthcare, manufacturing, and logistics sectors, according to a 2023 analysis by Cisco Talos.

🛡️ Mitigation

Organizations should apply security updates for CVEs CVE-2022-30190, CVE-2022-41040, and CVE-2022-41082; enforce application control to block PowerShell and WMI execution from untrusted sources; and deploy YARA rules from Sekoia’s public repository to detect MarraCrypt’s .NET loader and encrypted payloads. Regular offline backups and network segmentation remain critical defenses.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.