Hook: recovered C2 indicators & analysis

What Hook is

Hook is an Android banking trojan with remote-access-tool (RAT) capabilities that was first publicly reported in January 2023. It was advertised on a Russian-language underground forum by the actor known as DukeEugene, who was also associated with the earlier ERMAC and BlackRock families. Although Hook's author claimed it was written from scratch, ThreatFabric's analysis found that the majority of its code base is derived from ERMAC, including reused code and Russian-language comments; Hook is therefore generally assessed as an ERMAC fork or successor rather than a wholly new family. It was offered as malware-as-a-service on a subscription basis.

Hook inherits ERMAC's core banking-trojan functionality and extends it. It performs overlay (web-inject) attacks against a large set of banking and cryptocurrency applications to harvest credentials, logs keystrokes, intercepts and sends SMS messages, and monitors the clipboard (including substituting attacker-controlled cryptocurrency wallet addresses). It abuses Android accessibility services to read on-screen content and inject input. Its headline addition over ERMAC is a VNC-style remote-control / device-takeover (DTO) capability: operators can stream the victim's screen and drive the UI in real time via accessibility-driven gestures (taps and swipes), enabling a complete on-device fraud chain without an out-of-band channel. Reported capabilities also include taking photos with the front-facing camera, file-manager access to list and exfiltrate files, harvesting Google session cookies, geolocation retrieval, and interaction with messaging apps such as WhatsApp.

The original Hook project was reportedly shut down in April 2023 when DukeEugene announced they were stepping away; support was said to continue under an actor named RedDragon, and the source code was reportedly offered for sale on an underground forum in May 2023. In August 2025, Zimperium's zLabs documented a substantially expanded variant tracked as Hook version 3, which they reported supports 107 remote commands (38 of them new). This variant adds a full-screen ransomware-style extortion overlay (triggered by a 'ransome' command and dismissed with 'delete_ransome') that displays a wallet address and amount fetched from the command-and-control server, along with fake NFC-capture overlays ('takenfc'), fraudulent card-entry and lock-screen overlays for capturing card data, PINs and unlock patterns, and transparent gesture-recording overlays. Zimperium also observed Hook samples being distributed via phishing sites and public GitHub repositories, in some cases alongside other families such as ERMAC and Brokewell.

For command-and-control, Hook communicates with attacker infrastructure over HTTP and added WebSocket-based communication (using the Socket.IO protocol) for real-time command delivery. Command payloads have been reported as encrypted with AES-256-CBC using a hardcoded key and then Base64-encoded. Targeting reported for early versions spanned banking apps across multiple countries including the United States, Spain, Australia, Poland, Canada, Turkey, the United Kingdom, France, Italy and Portugal, with the overlay target list numbering in the hundreds of applications.

Capabilities

• Overlay (web-inject) attacks against banking and cryptocurrency apps to steal credentials
• Keylogging
• VNC-style remote control / full device takeover via accessibility-driven gestures
• Real-time screen streaming and screenshots
• SMS interception and sending
• Accessibility-service abuse to read screen content and inject input
• Clipboard monitoring and cryptocurrency wallet-address substitution
• Front-facing camera photo capture
• File manager: list and download/exfiltrate device files
• Google session cookie harvesting
• Cryptocurrency wallet seed / recovery-phrase theft
• Geolocation retrieval
• Contact list, call log and installed-app enumeration
• Interaction with messaging apps (e.g., WhatsApp)
• Ransomware-style full-screen extortion overlay (Hook v3)
• Fake NFC-capture and card-entry / lock-screen overlays (Hook v3)

Known C2 / channel types: HTTP(S), WebSocket (Socket.IO).

MITRE ATT&CK (Mobile)

Techniques commonly associated with Hook:

What Privara Unmask recovered

Recovered from the executed sample during automated detonation on a de-emulated Android 17 device. The 2026-09-08 sample yielded its C2 host from recovered runtime configuration. A second sample (2026-09-14) was observed connecting to two high ports on a single host by the platform's kernel tracer — a kprobe on security_socket_connect, below the application, so the endpoints are observed rather than inferred from strings. The analysis ran on a de-emulated Android 17 device that the sample could not fingerprint as virtual, so it behaved as it would on a real handset.

Indicators of compromise (IOCs)

Recovered but withheld from the feed (precision over volume):

• 104.23.191.26 — Cloudflare edge address (104.16.0.0/12) found in the appended config blob and never contacted at runtime — a shared CDN IP, not an endpoint

External references

• Hook: a new Ermac fork with RAT capabilities
  ThreatFabric
• Hook Version 3: The Banking Trojan with The Most Advanced Capabilities
  Zimperium zLabs
• New 'Hook' Android malware lets hackers remotely control your phone
  BleepingComputer
• Hook: New Android Banking Trojan That Expands on ERMAC's Legacy
  The Hacker News
• HOOK Android Trojan Adds Ransomware Overlays, Expands to 107 Remote Commands
  The Hacker News

Methodology & honest limits

This sample was obtained from MalwareBazaar and detonated in a controlled, isolated environment. C2 identity was recovered from the executing sample and its configuration. We report only what the analysis established: an offline sample yields a C2 identity, not a live beacon, and we say so. Nothing here is inferred beyond the evidence.