ERMAC: recovered C2 indicators & analysis

What ERMAC is

ERMAC was first documented in September 2021 by ThreatFabric, which attributed it to a threat actor known as DukeEugene, the same operator previously associated with the BlackRock Android trojan. Its earliest versions were built largely on the source code of Cerberus, an earlier banking trojan whose code was leaked publicly in September 2020 after a failed auction. ERMAC was offered as a malware-as-a-service (MaaS) rental, advertised at roughly $3,000 per month in its initial promotion.

The family expanded steadily across versions. The initial version was reported to target 378 banking and wallet apps and appeared in campaigns (notably against users in Poland) distributed as a fake Google Chrome app. A later ERMAC 2.0, reported around 2022, was rented at about $5,000 per month and targeted on the order of 400 to 467 applications. ERMAC v3.0 further expanded form-injection and data-theft targeting to more than 700 banking, shopping, and cryptocurrency apps; its full source code was obtained by researchers (Hunt.io dated the acquisition to March 2024) and detailed publicly in August 2025. By late 2023 the code base had also incorporated portions of the related Hook botnet, itself a successor/fork developed by the same operator.

ERMAC's core technique is the overlay attack: it uses Android's WebView to display fake login windows on top of legitimate banking and cryptocurrency apps to capture credentials and payment details. It combines this with keylogging and interception of incoming SMS messages, enabling theft of one-time passcodes and multi-factor authentication codes. Additional capabilities documented across versions include stealing contact lists and registered device accounts (such as Google accounts), harvesting Gmail message subjects and content, sending SMS and initiating calls, configuring call forwarding, capturing photos with the front camera, displaying custom/fake push notifications, managing applications (launch, uninstall, clear cache), and removing itself from the device. It abuses the Android Accessibility Service to help automate on-device actions.

ERMAC communicates with its command-and-control (C2) infrastructure over HTTP(S) using encrypted traffic; the v3.0 source code showed AES-CBC-based encryption of communications. The leaked v3.0 code base revealed a full operator ecosystem consisting of a PHP/Laravel backend for bot management and injection delivery, a React-based operator frontend panel, a separate Golang exfiltration server, and an Android builder panel used to generate malicious APKs. The leak also exposed weak operational security in the platform itself, including a hardcoded JWT secret, a static admin bearer token, default root credentials, and open account registration on the admin panel.

Capabilities

• Overlay attacks (WebView-based fake login windows) against banking, crypto, and shopping apps
• Keylogging of user input
• SMS interception (incoming messages)
• SMS sending and phone-call initiation
• Call forwarding setup
• Theft of one-time passcodes / MFA codes via SMS
• Contact list theft
• Stealing registered device accounts (e.g., Google)
• Harvesting Gmail message subjects and content
• Front-camera photo capture
• Custom / fake push notifications
• Application management (launch, uninstall, clear cache)
• Abuse of the Android Accessibility Service to automate actions
• Self-removal / remote uninstall

Known C2 / channel types: HTTP(S) REST.

MITRE ATT&CK (Mobile)

Techniques commonly associated with ERMAC:

What Privara Unmask recovered

The C2 endpoint (host and port) was recovered from the sample's configuration during automated detonation. The analysis ran on a de-emulated Android 17 device that the sample could not fingerprint as virtual, so it behaved as it would on a real handset.

Indicators of compromise (IOCs)

External references

• ERMAC V3.0 Banking Trojan: Full Source Code Leak and Infrastructure Analysis
  Hunt.io
• ERMAC Android malware source code leak exposes banking trojan infrastructure
  BleepingComputer
• Hook: a new Ermac fork with RAT capabilities
  ThreatFabric
• New Android Malware Steals Financial Data from 378 Banking and Wallet Apps
  The Hacker News
• ERMAC V3.0 Banking Trojan Source Code Leak Exposes Full Malware Infrastructure
  The Hacker News
• ERMAC 2.0: Perfecting the Art of Account Takeover
  Intel 471

Methodology & honest limits

This sample was obtained from MalwareBazaar and detonated in a controlled, isolated environment. C2 identity was recovered from the executing sample and its configuration. We report only what the analysis established: an offline sample yields a C2 identity, not a live beacon, and we say so. Nothing here is inferred beyond the evidence.