HookBot & ERMAC Source Leak: Exposed Android Banking Trojan Panels Enable Mass Operator Proliferation — OTX Detection Pack

Intelligence Category: APT & Nation-State / Crimeware-as-a-Service Intelligence TLP: WHITE | Attribution: DukeEugene | Targeted Sector: Finance Severity Assessment: HIGH — active C2 infrastructure, leaked builder enabling uncontrolled proliferation

Threat Summary

AlienVault OTX pulse data confirms that the ERMAC and HookBot Android banking trojan families — two branches of a single malware-as-a-service (MaaS) operation — have suffered a catastrophic source code leak. In August 2025, a complete copy of the malware builder, Laravel-based C2 backend, and React administrative panel leaked into circulation. Critically, unrelated threat operators are now deploying these panels with default credentials and cryptographic keys still in place, dramatically lowering the barrier to entry for running a full banking trojan operation.

The confirmed lineage runs: Cerberus → ERMAC → Hook (HookBot), validated through direct source code analysis by Censys researchers. The Cerberus codebase famously leaked in 2020 after its author failed to auction it, and ERMAC emerged from that code — HookBot then forked from ERMAC with enhanced capabilities including WebSocket-based near-real-time device control.

The collective intelligence reveals a proliferation event, not a single campaign. Because the backend leaked with intact secrets, defenders can now fingerprint opportunistic operators who failed to rotate credentials — but simultaneously face a growing pool of independent HookBot/ERMAC instances targeting banking applications and cryptocurrency wallets via Android overlay attacks, accessibility-service abuse, and credential interception. The 19 indicators in this pulse represent live, attributable infrastructure actively serving C2 functions as of this reporting date.

Objective: Financial theft via credential harvesting (overlay injection against banking apps), session hijacking, cryptocurrency wallet draining, and SMS-based 2FA interception on compromised Android devices.

Threat Actor / Malware Profile

Attribution: DukeEugene

The ERMAC/Hook operation is attributed to the actor DukeEugene, who marketed the platform on Russian-language cybercrime forums as a subscription MaaS (historically ~$5,000/month for ERMAC, scaling for Hook's premium tiers).

Lineage & Family Capabilities

Distribution

• Malicious droppers disguised as Chrome updates, banking apps, and utility APKs
• Smishing (SMS phishing) campaigns delivering APK download links
• Third-party app stores and malvertising landing pages
• Post-leak: any operator can now build signed payloads with the leaked builder

Payload Behavior

1. Overlay injection — displays pixel-perfect fake login screens over legitimate banking/crypto apps (tags confirm overlay attacks, cryptocurrency wallets)
2. Accessibility Service abuse — requested immediately post-install; used for keylogging, auto-granting permissions, preventing uninstall, and reading screen content
3. SMS interception — harvests OTP/2FA codes and exfiltrates message history
4. Credential & clipboard theft — including seed phrases copied from wallet apps
5. Screen capture & VNC-style remote control (Hook's WebSocket channel enables near-real-time operator interaction)

C2 Communication

• HTTP/HTTPS panel communication (Laravel backend) with WebSocket channels for Hook's real-time command stream
• Leaked panels expose predictable Laravel/React fingerprints (default .env values, default API keys, default admin routes like /login with vendor-default sessions)
• C2 infrastructure in this pulse spans fast-flux-style hosting across multiple ASNs

Persistence

• Device Administrator privileges
• Accessibility Service persistence (survives reboots)
• Overlay/windows permission retention
• Battery optimization exclusion requests

Anti-Analysis

• Emulator and sandbox detection
• String obfuscation inherited from Cerberus codebase
• Geofencing (refuses execution in non-target regions)
• Post-leak operators frequently deploy panels unchanged — a defensive gift: default panel fingerprints are highly detectable via internet scanning and egress monitoring

IOC Analysis

This pulse contains 19 indicators across two observable types:

Network Indicators — Domains/Hostnames (2 shown):

• havijmail.com (domain)
• ces.yeyr.lol (hostname — C2/panel endpoint on a low-reputation TLD)

Network Indicators — IPv4 (6 shown): 185.99.255.17, 93.127.141.93, 45.207.206.169, 212.193.23.223, 118.107.45.73, 118.107.45.29

Operationalization Guidance for SOC Teams

1. Block immediately at DNS sinkhole, web proxy, and egress firewall. The .lol TLD hostname and the panel IPs carry essentially zero legitimate-business probability for enterprise egress.
2. Pivot on infrastructure: feed the IPs into Censys/Shodan to identify co-hosted Laravel panels (search for ERMAC/Hook panel favicon hashes and default TLS certificate patterns). The source leak means many panels share identical fingerprints.
3. Retro-hunt egress logs for 90 days: any corporate device or guest/BYOD network segment communicating with these IPs indicates a compromised Android device.
4. Tooling for decoding: Use Censys (panel fingerprinting), VirusTotal (passive DNS on the domains), urlscan.io (panel login page capture), and your OTX DirectConnect/TAXII feed integration for automated indicator ingestion into SIEM/EDR blocklists.
5. MDM/mobile telemetry: correlate against Android devices in your fleet with sideloaded APKs, enabled accessibility services from non-Google packages, or overlay permissions granted to unknown apps.

Detection Engineering

---
title: ERMAC HookBot C2 Infrastructure Communication
id: 8f2a1c4d-9b3e-4f7a-a1c2-ermachook001
status: experimental
description: Detects DNS resolution or network communication to known ERMAC/HookBot C2 domains and IPs identified in OTX pulse on the leaked HookBot panel proliferation
date: 2026/08/25
author: Security Arsenal Threat Intelligence
logsource:
    category: dns
product: windows
 detection:
    selection_domain:
        query_name|contains:
            - 'havijmail.com'
            - 'yeyr.lol'
            - 'ces.yeyr.lol'
    condition: selection_domain
falsepositives:
    - Threat intelligence platform lookups by security analysts
level: high
tags:
    - attack.command_and_control
    - attack.t1071
---
title: ERMAC HookBot C2 IPv4 Connection Attempt
id: 7c1b2e5f-4a8d-4e9b-b3d4-ermachook002
status: experimental
description: Detects outbound network connections to known ERMAC/HookBot C2 IP addresses from the leaked panel infrastructure set
date: 2026/08/25
author: Security Arsenal Threat Intelligence
logsource:
    category: network_connection
product: windows
detection:
    selection_ip:
        DestinationIp:
            - '185.99.255.17'
            - '93.127.141.93'
            - '45.207.206.169'
            - '212.193.23.223'
            - '118.107.45.73'
            - '118.107.45.29'
    condition: selection_ip
falsepositives:
    - Rare; these IPs serve dedicated criminal panel infrastructure
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
---
title: Exposed Laravel Admin Panel Access Pattern - HookBot ERMAC Backend
id: 3e9c7a1b-2f5d-4c8a-c5e6-ermachook003
status: experimental
description: Detects inbound or outbound web requests matching leaked ERMAC/HookBot Laravel panel default paths and fingerprints, indicating interaction with a trojan operator panel or an exposed default deployment
date: 2026/08/25
author: Security Arsenal Threat Intelligence
logsource:
    category: proxy
detection:
    selection_uri:
        c-uri|contains:
            - '/api/v1/application'
            - '/laravel-login'
            - '/panel/api/bot'
            - '/build/assets/index-'
    selection_host:
        c-dns|contains:
            - 'havijmail.com'
            - 'yeyr.lol'
    condition: selection_uri or selection_host
falsepositives:
    - Security research or scanning of criminal infrastructure
level: high
tags:
    - attack.command_and_control
    - attack.t1102

// Hunt for ERMAC/HookBot C2 communication and panel interaction (Microsoft Sentinel / Defender XDR)
let HookErmacIPs = dynamic(["185.99.255.17","93.127.141.93","45.207.206.169","212.193.23.223","118.107.45.73","118.107.45.29"]);
let HookErmacDomains = dynamic(["havijmail.com","yeyr.lol","ces.yeyr.lol"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteIP in (HookErmacIPs) or RemoteUrl has_any (HookErmacDomains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType),
    (DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where ProcessCommandLine has_any (HookErmacDomains) or ProcessCommandLine has_any (HookErmacIPs)
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName, SHA256),
    (CommonSecurityLog
    | where TimeGenerated > ago(30d)
    | where DestinationIP in (HookErmacIPs) or RequestURL has_any (HookErmacDomains)
    | project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestURL, DeviceAction)
| sort by TimeGenerated desc

# ERMAC / HookBot Enterprise Hunt Script
# Checks endpoints for network artifacts tied to leaked HookBot/ERMAC panel infrastructure
# Run elevated; suitable for fleet-wide execution via RMM/Intune/SCCM

$ErrorActionPreference = 'SilentlyContinue'
$C2IPs = @('185.99.255.17','93.127.141.93','45.207.206.169','212.193.23.223','118.107.45.73','118.107.45.29')
$C2Domains = @('havijmail.com','yeyr.lol','ces.yeyr.lol')
$Findings = @()

Write-Host "[+] Security Arsenal HookBot/ERMAC IOC Hunt - $(Get-Date -Format 'yyyy-MM-dd HH:mm')" -ForegroundColor Cyan

# 1. Active TCP connections to C2 IPs
foreach ($ip in $C2IPs) {
    $conns = Get-NetTCPConnection | Where-Object { $_.RemoteAddress -eq $ip }
    foreach ($c in $conns) {
        $proc = Get-Process -Id $c.OwningProcess
        $Findings += [PSCustomObject]@{
            Type='ActiveConnection'; Indicator=$ip
            Detail="PID $($c.OwningProcess) [$($proc.ProcessName)] State=$($c.State) LocalPort=$($c.LocalPort)"
        }
    }
}

# 2. DNS resolver cache hits for C2 domains
$dnsCache = Get-DnsClientCache | Where-Object { foreach ($d in $C2Domains) { $_.Entry -like "*$d*" } }
foreach ($entry in $dnsCache) {
    $Findings += [PSCustomObject]@{ Type='DNSCache'; Indicator=$entry.Entry; Detail="Resolved: $($entry.Data)" }
}

# 3. Proxy/firewall-style artifacts: check hosts file tampering (banker overlay C2 sometimes pinned)
$hostsEntries = Get-Content "$env:SystemRoot\System32\drivers\etc\hosts" |
    Where-Object { $_ -match ($C2Domains -join '|') -or $_ -match ($C2IPs -join '|') }
foreach ($h in $hostsEntries) {
    $Findings += [PSCustomObject]@{ Type='HostsFile'; Indicator='hosts'; Detail=$h }
}

# 4. Suspicious sideload/Android-adjacent artifacts: check for ADB remote sessions & emulator-bypass tooling
$adb = Get-Process adb -ErrorAction SilentlyContinue
if ($adb) {
    $adbConns = Get-NetTCPConnection -OwningProcess $adb.Id | Where-Object { $C2IPs -contains $_.RemoteAddress }
    foreach ($a in $adbConns) {
        $Findings += [PSCustomObject]@{ Type='ADBtoC2'; Indicator=$a.RemoteAddress; Detail="ADB session to C2 IP - investigate managed device exfil" }
    }
}

# 5. Scheduled tasks launching from user-writable paths (droppers often persist this way when detonated on Windows for analysis)
Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match 'AppData|Temp|Public' -and $_.State -eq 'Ready'
} | ForEach-Object {
    $Findings += [PSCustomObject]@{ Type='ScheduledTask'; Indicator=$_.TaskName; Detail=$_.Actions.Execute }
}

if ($Findings.Count -gt 0) {
    Write-Host "[!] $($Findings.Count) finding(s) - ESCALATE to IR:" -ForegroundColor Red
    $Findings | Format-Table -AutoSize
    $Findings | Export-Csv -Path "$env:TEMP\hookbot_ermac_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
} else {
    Write-Host "[OK] No HookBot/ERMAC indicators found on this host." -ForegroundColor Green
}

Response Priorities

Immediate (0–4 hours)

• Block all 19 OTX indicators at DNS, proxy, and egress firewall layers; push to EDR network-protection policies
• Execute the KQL hunt across the last 30–90 days of network telemetry; any hit = compromised device, isolate immediately
• Pull MDM/MAM inventory for Android devices with sideloaded APKs, non-Google accessibility services enabled, or draw over other apps permissions granted to unknown packages
• Verify none of the listed C2 IPs appear in third-party/vendor network segments or guest Wi-Fi egress

24 Hours

• HookBot/ERMAC are credential-stealing bankers — for any potentially exposed user (mobile banking session from an unmanaged or flagged device), force password resets and session/token revocation on financial and crypto platforms
• Review cryptocurrency wallet activity for corporate treasury or employee-reported drains; clipboard seed-phrase theft is a documented Hook behavior
• Audit SMS-delivered 2FA reliance: migrate high-risk users off SMS OTP toward FIDO2/passkeys, since SMS interception defeats this control entirely
• Scan for exposed Laravel panels internally (the leaked backend means default-cred panels may also exist as shadow-IT compromise vectors)

1 Week

• Enforce MDM policy hardening: block APK sideloading on managed devices, restrict accessibility service grants to an allowlist, disable overlay permissions by default
• Deploy mobile threat defense (MTD) telemetry into Sentinel to detect Cerberus-lineage overlay behavior signatures
• Build a Censys/Shodan monitoring rule for ERMAC/Hook default panel fingerprints — the source leak guarantees new operator panels will keep appearing; fingerprint-based detection outlasts static IOCs
• Threat-model smishing delivery: brief the help desk and run an Android-focused phishing simulation targeting financial-application lures

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub