Leaked ERMAC and HookBot Source Reveals Shared Lineage and Detection Gaps

Aug 25, 2026 · Original article ↗

Summary

Analysis of leaked ERMAC and HookBot code traces their shared lineage, details the Android banking trojans’ infrastructure and capabilities, and finds that a firewall gate leaves the builder exposed to scanning.

Key points

The leaked builder, Laravel backend, and React panel show ERMAC and HookBot share code descended from Cerberus; the article identifies matching API structure and 21 shared database migrations.
The Android banking trojans use fake login overlays and accessibility permissions to steal credentials and intercept confirmation codes. Their bundled overlay list covers 484 apps across more than 40 countries.
HookBot’s IP-whitelist gate filters access to the panel, API, and implant socket, but does not cover the builder port, leaving builder-related indicators visible.
HookBot source includes hardcoded default gate credentials and a Telegram bot that can relay stolen credentials, two-factor codes, intercepted SMS, and operator commands.
Censys observed 266 distinct HookBot-labeled IPs and 55 ERMAC-labeled IPs over a year. HookBot host counts peaked at 58 in September 2025, then fell to 6 in June 2026.
The article identifies the builder’s 13 co-occurring obfuscator flags as a more durable detection signal than easily changed panel titles or body hashes.

Article Details

Attack Vectors: The Android implant uses app-specific overlays that imitate banking or other target apps to capture credentials.
The implant requests Android accessibility permissions, which allow it to monitor screens and interact with apps.
The malware forwards SMS messages, including confirmation codes, from infected phones.
Distribution relies on sideloaded APKs promoted through fake update pages, links, GitHub file hosting, and Telegram channels.
Hook can send an APK link from an infected phone through WhatsApp; recipients still have to install the APK and grant accessibility permissions.
Hook adds VNC-based remote screen control and a self-propagation command named openwhatsapp.
Defensive Notes: Hunt for the builder and its 13 co-occurring ch_* obfuscator strings; the article reports these strings cannot be renamed without breaking the build.
The builder is exposed on port 8088, which is outside the HookBot security gate's rules for ports 80, 8089, and 8000.
The HookBot gate returns PROTECTED AREA on an unauthenticated request to port 50000; the article identifies this response as a detection artifact.
Panel titles and body hashes may be changed or become stale; the article recommends corroborating the hook_session cookie with another fingerprint such as a favicon, body string, or title pattern.
A panel disappearing from passive scans may reflect IP-whitelist filtering rather than shutdown; verify whether the service is observable before relying on reported port status.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`ces[.]yeyr[.]lol`	ERMAC-labeled hostname hosted on 137.220.219[.]244.
DOMAIN	`errr[.]onllee[.]com`	ERMAC-labeled hostname hosted on 137.220.219[.]244.
DOMAIN	`havijmail[.]com`	ERMAC 3.0 panel domain, dual-labeled ERMAC and HookBot by Censys.
DOMAIN	`orapopo[.]store`	Domain labeled as ERMAC panel infrastructure from 2026-07-02 to 2026-07-17.
DOMAIN	`vps-d798fb0f[.]vps[.]ovh[.]net`	HookBot panel domain; the article identifies 51.38.113[.]113 as its origin.
DOMAIN	`www[.]racon[.]online`	ERMAC 3.0 panel domain, dual-labeled ERMAC and HookBot by Censys.
IPV4	`103[.]118[.]199[.]85`	Reported Hook C2 host on port 50555; Censys did not index services there.
IPV4	`118[.]107[.]45[.]29`	HookBot host; the article reports its panel port disappeared after the IP-whitelist gate was enabled.
IPV4	`118[.]107[.]45[.]70`	HookBot host; the article reports its panel port disappeared after the IP-whitelist gate was enabled.
IPV4	`118[.]107[.]45[.]73`	HookBot host; the article reports its panel port disappeared after the IP-whitelist gate was enabled.
IPV4	`118[.]107[.]5[.]135`	ERMAC C2/panel host observed on port 8088; the article says it was later repurposed.
IPV4	`137[.]220[.]219[.]244`	Longest-lived ERMAC-labeled panel host; it hosted ces.yeyr[.]lol and errr.onllee[.]com.
IPV4	`185[.]99[.]255[.]17`	Host that served a HOOKBOT PANEL V5.5; the panel was later reported gone.
IPV4	`212[.]193[.]23[.]223`	Reported Hook C2 host on ports 8089 and 50555; no services were indexed.
IPV4	`45[.]207[.]206[.]169`	Host that served an open directory containing the ERMAC 3.0 stack.
IPV4	`51[.]38[.]113[.]113`	Origin IP for the HookBot panel hostname vps-d798fb0f.vps.ovh[.]net.
IPV4	`62[.]169[.]31[.]177`	Reported Hook C2 host on port 80; the article says it was rotated off.
IPV4	`77[.]73[.]135[.]34`	HookBot builder host on port 8088, reported live at publication.
IPV4	`82[.]158[.]90[.]131`	HookBot infrastructure exposing the API on port 8089 and socket on port 8000.
IPV4	`82[.]158[.]90[.]133`	HookBot panel host exposing the API and socket; panel reported on port 50555.
IPV4	`82[.]158[.]90[.]134`	HookBot infrastructure with the same exposed service surface as 82.158.90[.]133.
IPV4	`93[.]127[.]141[.]93`	Reported Hook C2 host on port 80; the article says it was rotated off.
MD5	`0452650b0b1e7eeaf01bd74e927a4dd7`	ERMAC panel favicon hash used as a detection artifact.
MD5	`90a61dcc76d704b2e861a0465ced2f87`	HookBot panel favicon hash used as a detection artifact.
SHA256	`10cdbf95c65e1ac64ba341551c7524f0153d4aa6e3df1cc66a629b5f65f6a56c`	Hash of an ERMAC signed build, version 8.
SHA256	`3991246a9f124baef285f53fa1bf63f325bcf2f16a5ef02dd055349caf5b1dab`	Hash of an ERMAC APK produced by the recovered builder.
SHA256	`54536eda036ae8d15baba8e6f7236a5a895e49fe4fe00413cf8e61ffe9ec8353`	Hash of an ERMAC APK produced by the recovered builder.
SHA256	`6a2cada709868f96a488b1167270c04d771a52adb3cc538d683d6cdf1dc3d7a0`	Hash of an ERMAC signed build, version 3.
SHA256	`6c3c7e9d2d2b180f40e8effc5c2de58744d8502c2336c197cb3f2f2e094766ab`	Hash of an ERMAC signed build, version 7.
SHA256	`8f2b1ddb2cbe98ddeb92a14434da8ad5076a72a5491a80d87fd037f2d74d73af`	Hash of an ERMAC signed build, version 2.
SHA256	`96411de04d2511f35481d5803aa6bfb2d9fc48c17c0362ef7d9f429837b35b1f`	Hash of an ERMAC signed build, version 5.
SHA256	`a8b0ee73d386fe7dbd9be196197421cd87a0672a20b34fc7bbaf2c6016b2f5f6`	Hash of the unsigned base APK identified as input to the malware repack.
SHA256	`b75bb1b99e0157cbc5ea7d3e6cfec967c9b2466f1d24403e95be7608869b5ce4`	Hash of an ERMAC signed build, version 4.
SHA256	`ef56aba60776990fd585b0a853588eb141a71ebd496adbea495c96b08a2746d2`	Hash of an ERMAC signed build, version 6.
SHA256	`f6ae6018366457ee74eba8d14c164a35d4d57b93e1f346455a4b771e8ab46e07`	Hash of an ERMAC signed build, version 9.