ERMAC 3.0 Source Leak Reveals Android Banking Trojan’s Capabilities and Infrastructure
Summary
Analysis of leaked ERMAC 3.0 source code details an Android banking trojan targeting more than 700 apps, its command-and-control infrastructure, data theft capabilities, and security weaknesses defenders can use to detect and disrupt it.
Key points
- The researchers obtained ERMAC 3.0 source code, including its PHP/Laravel backend, React control panel, Go exfiltration server, and Android builder.
- The Android malware targets more than 700 banking, shopping, and cryptocurrency apps with form injections that can steal credentials and payment data.
- Its capabilities include stealing SMS, contacts, account and device information, retrieving email content, taking photos, and controlling infected devices.
- The report describes weak backend security, including hardcoded secrets and credentials and an account-registration route that could expose admin access.
- Researchers correlated distinctive panel titles, HTTP markers, and cookies with active ERMAC infrastructure, and provide queries to help defenders find related servers.
- The article recommends hunting for ERMAC infrastructure, blocking known malicious hosts, detecting overlays, and scanning APKs with a YARA rule.
Article Details
- Attack Vectors
- ERMAC uses Android form injections and overlays to capture credentials and payment information from targeted banking, shopping, and cryptocurrency applications.
- The Android backdoor collects device data, SMS messages, contacts, account details, installed applications, email content, and files, then sends collected information to ERMAC infrastructure.
- ERMAC can control compromised devices through commands including sending SMS messages, forwarding calls, launching applications, and taking photos.
- Defensive Notes
- Use Android FLAG_SECURE and runtime detection or blocking of overlays to reduce exposure to overlay attacks.
- Identify and disrupt ERMAC C2 and exfiltration infrastructure; block Android applications that reference known ERMAC IP addresses or domains.
- Monitor for ERMAC-specific HTTP headers, hardcoded nonces, and panel titles.
- Use proactive threat hunting and share indicators with trusted threat-intelligence networks; coordinate with hosting providers to remove exposed panels and exfiltration servers.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 121[.]127[.]231[.]161 | Identified as an ERMAC exfiltration server. |
| IPV4 | 121[.]127[.]231[.]163 | Identified as an ERMAC exfiltration server. |
| IPV4 | 121[.]127[.]231[.]198 | Identified as an ERMAC exfiltration server. |
| IPV4 | 141[.]164[.]62[.]236 | Open directory identified as hosting the ERMAC 3.0 source-code archive. |
| IPV4 | 172[.]191[.]69[.]182 | Identified as an ERMAC C2 server. |
| IPV4 | 20[.]162[.]226[.]228 | Identified as an ERMAC C2 server. |
| IPV4 | 206[.]123[.]128[.]81 | Identified as an older ERMAC panel. |
| IPV4 | 43[.]160[.]253[.]145 | Identified ERMAC panel, exfiltration server, and C2 infrastructure at different ports. |
| IPV4 | 5[.]188[.]33[.]192 | Mentioned in ERMAC source code as a potentially outdated panel or C2 server. |
| IPV4 | 91[.]92[.]46[.]12 | Identified as an ERMAC 3.0 panel. |
| IPV4 | 98[.]71[.]173[.]119 | Identified as an ERMAC C2 server. |
| SHA256 | 175d4adc5fc0b0d8eb4b7d93b6f9694e4a3089e4ed4c59a2828d0667a9992aaa | SHA-256 hash of the ERMAC source-code archive Ermac 3.0.zip. |
| SHA256 | 8c81cebbaff9c9cdad69257f50af0f5208a0d5923659b4e0c3319333f9e8d545 | SHA-256 hash of the compiled ERMAC exfiltration server server_go. |
MITRE ATT&CK
T1056.001 · KeyloggingThe article's ATT&CK mapping says ERMAC includes keylogging to capture user input across applications.T1056.002 · GUI Input CaptureERMAC uses form injection to capture form data from Android applications.T1437.001The article describes ERMAC communicating with its C2 server over HTTP/S.
Malware
CerberusIts earliest versions were built using the leaked Cerberus source code, and by late 2023, version 2.0 had incorporated large portions of the Hook botnet's codebase. The newly uncovered version 3.0 reveals a significantERMACIn March 2024, Hunt.io discovered and obtained the complete ERMAC V3.0 source code, giving us a rare opportunity to study a live and actively maintained Malware-as-a-Service platform from the inside. Full source codeHookthe leaked Cerberus source code, and by late 2023, version 2.0 had incorporated large portions of the Hook botnet's codebase. The newly uncovered version 3.0 reveals a significant evolution of the malware,
Products
AndroidHunt.io obtained the full ERMAC V3.0 source code, including its PHP and Laravel backend, React-based frontend, Golang exfiltration server, and Android builder panel.LaravelHunt.io obtained the full ERMAC V3.0 source code, including its PHP and Laravel backend, React-based frontend, Golang exfiltration server, and Android builder panel.ReactHunt.io obtained the full ERMAC V3.0 source code, including its PHP and Laravel backend, React-based frontend, Golang exfiltration server, and Android builder panel.WebViewshopping, and other financial applications primarily through web injects. It relies on Android's WebView API to place an overlay on top of legitimate apps, capturing credentials and payment information.
Tools
Hunt.io AttackCaptureHuntSQLAnalysis with HuntSQL linked the leaked files to active ERMAC C2 panels, exfiltration servers, and builder deployments still operating online.obfuscapkFig 15: ERMAC Builder Panel UIOn each build, ERMAC uses obfuscapk to obfuscate the Android application, giving it a unique hash and obfuscating class names, strings, manifest properties, and more.
Industries
Bankingof the malware, expanding its form injection and data theft capabilities to target more than 700 banking, shopping, and cryptocurrency applications.Cryptocurrencyits form injection and data theft capabilities to target more than 700 banking, shopping, and cryptocurrency applications.Shoppingthe malware, expanding its form injection and data theft capabilities to target more than 700 banking, shopping, and cryptocurrency applications.