> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# What the ERMAC Source Leak Says About HookBot
- URL: https://f4n6.co.uk/security-feed/what-the-ermac-source-leak-says-about-hookbot/
- Published: 2026-08-25T21:44:56.000Z
- Updated: 2026-08-25T21:44:56.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

Censys reports that the August 2025 publication of ERMAC 3.0 source code exposed a deployable Android banking-trojan stack comprising the implant builder, Laravel backend, React panel, WebSocket relay and Obfuscapk tooling. ERMAC and HookBot share the same code lineage; operators use side-loaded Android applications, accessibility permissions and app-specific overlays to steal credentials and confirmation codes, with HookBot additionally supporting VNC control, file management, WhatsApp propagation and Telegram-based operation. EMEA financial institutions are exposed through impersonation and account-takeover risk: the supplied configuration includes overlays for Turkish banks, earlier Polish campaigns and broader targeting of Turkey, Spain, Poland, Portugal and cryptocurrency services, but it contains no victim data and does not establish compromise of any client. The supplied verified reference data resolves no CVE, CVSS score, severity rating or CISA KEV exploitation state for this item; all substantive findings and indicators are single-sourced to Censys and should be verified before enforcement.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The source also establishes no client incident, material service disruption or affected OES/RDSP service that would create an item-specific UK NIS 2018 mapping; obligations should be reassessed if client telemetry confirms credential theft, fraudulent transactions or service impact.

## 3\. Technical analysis & attack chain

The following chain is confirmed within the supplied Censys material but is not independently corroborated. The related-source extract duplicates the primary source and does not constitute a second source. Infrastructure, prevalence and attribution claims are therefore **single-sourced; verify before enforcement**. [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk)

1. **Delivery and user-assisted installation.** Operators distribute implant APKs outside Google Play through fake update pages, direct APK links, GitHub file hosting and Telegram channels. Hook can also use the `openwhatsapp` command to send a lure from an infected device’s WhatsApp account. The recipient must still open the link, approve side-loading and grant Android accessibility permissions.
2. **Disguise and execution.** HookBot’s manifest contains 20 activity aliases from which an operator can select a launcher identity. Supplied labels and icons impersonate Chrome, WhatsApp, Instagram, Telegram, TikTok, Facebook, Gmail, Google Play, YouTube and Contacts.
3. **Accessibility abuse and overlay theft.** Once accessibility access is granted, the implant can observe screens and interact with applications. When a targeted banking or wallet application opens, the implant places a prepared imitation login screen over the legitimate application approximately half a second later. Credentials entered into the overlay are sent to the operator.
4. **Authentication-code interception and exfiltration.** The implant intercepts SMS and other stolen data, including confirmation codes. ERMAC 3.0 and HookBot retain a base64-encoded POST structure with an encrypted request body and request-type switch inherited from Cerberus; the server-side cipher changed from Cerberus’ RC4 to AES-128-CBC.
5. **Command-and-control and operator access.** The panel lists infected devices, stores logs and injection records, holds the overlay library and issues commands. The Docker stack exposes a Laravel API, Workerman implant socket, WebSocket relay and APK builder. Hook’s command set grew from ERMAC’s 30 commands to 58 in Hook v1 and 68 in v2, adding VNC remote-screen control, a file manager, WhatsApp manipulation and propagation.
6. **Operational use and impact.** HookBot’s ASP.NET Telegram application can deliver stolen credentials, intercepted SMS and authorization codes to the operator and accept commands through Telegram. The resulting risk is account takeover and payment or wallet fraud. The supplied data contains no confirmed victims, losses or client compromises.

### Vulnerability and platform status

This chain does not depend on a reported CVE. Initial access requires social engineering, side-loading and user approval of accessibility access. The supplied verified reference data resolves no CVE, CVSS severity or CISA KEV exploitation state.

The source describes no Android privilege-escalation mechanism or implant persistence method. Accessibility access gives the implant extensive control without establishing that it gains root privileges. No enterprise-network lateral movement is reported; `openwhatsapp` is contact-based propagation from an infected device rather than network lateral movement.

### Code lineage and leaked components

The published material comprised:

- Laravel 10 backend running PHP 8.1 with Eloquent, JWT and Sanctum.
- React and TypeScript operator panel.
- WebSocket relay.
- APK builder using Obfuscapk and `apktool`.
- Docker Compose deployment configuration.
- MySQL 8.0 datastore.
- HookBot-only IP-whitelist security gate and ASP.NET Telegram application.

Censys reports direct structural correspondence between Cerberus request objects and ERMAC controller methods, including:

| Cerberus operation | ERMAC 3.0 operation |
| ------------------ | ------------------- |
| getBots            | getBotsList         |
| botsSetCommand     | sendBotsCommand     |
| deleteBots         | deleteBot           |
| mainStats          | getStats            |
| editComment        | editBotComment      |

ERMAC 3.0 and HookBot also share 21 database migrations with matching timestamps. A `panelName` constant contains `ERMAC` in one tree and `Hook` in the other, allowing trivial rebranding. ERMAC 3.0 retains Hook-named directories and differs principally through the panel-name change, removed Telegram routes and a relay rewrite.

The inherited configuration includes admin credentials seeded through `DatabaseSeeder.php`. ERMAC 3.0 and HookBot also share an AES key and initialization vector carried unchanged from `.env.example`; recovered deployments retained shipped values. HookBot source additionally contains Telegram bot tokens and a MySQL root password. Those secrets are deliberately excluded from this advisory.

### Server architecture and exposed services

| Component             | Function                                                                      | Published port or route          |
| --------------------- | ----------------------------------------------------------------------------- | -------------------------------- |
| nginx                 | React panel and reverse proxy                                                 | 80 panel, 8089 API, 8088 builder |
| php                   | Laravel backend and Workerman socket                                          | 8000                             |
| node                  | React build process                                                           | Build-only                       |
| mysql                 | Bot, log and injection storage                                                | 3306                             |
| golang                | Implant-facing relay; recovered stack actually runs Node.js server.js with ws | 3434                             |
| builder               | Obfuscapk and apktool APK builder                                             | 8088, 9090                       |
| phpmyadmin            | Database administration                                                       | Proxied through /mssql/          |
| HookBot security gate | Temporary IP allowlisting                                                     | 50000                            |

The source repeatedly identifies `8088` as the builder and `8000` as the Workerman socket. One sentence incorrectly describes `8000` as the builder port; the supplied port table, Docker mapping and firewall analysis consistently place the builder on `8088`.

Protected Laravel routes are under `/api/v1/` and use `auth:sanctum`. The smart-injection route group is declared as a sibling of the protected middleware group, allowing unauthenticated callers to read and write injection-session records. No CVE or formal severity is assigned to this design exposure.

### HookBot security gate

HookBot’s `security/` component creates an `ipset` allowlist and inserts the following rules into `DOCKER-USER`:

```bash
iptables -I DOCKER-USER -i ens3 -m set ! --match-set whitelist src -p tcp --dport 80 -j DROP
iptables -I DOCKER-USER -i ens3 -m set ! --match-set whitelist src -p tcp --dport 8089 -j DROP
iptables -I DOCKER-USER -i ens3 -m set ! --match-set whitelist src -p tcp --dport 8000 -j DROP

```

An Express service on TCP `50000` uses HTTP Basic authentication. Successful authentication runs `ipset add whitelist <ip>` and schedules removal after 12 hours. Unauthorized requests return `PROTECTED AREA` with HTTP status `401`.

The supplied rules hide the panel, API and Workerman implant socket but do not cover builder port `8088`. This makes the builder a more durable discovery point than panel titles or favicons. Censys states that the builder exposes 13 co-occurring `ch_*` Obfuscapk flags whose renaming would break the build pipeline, but the individual flag strings are absent from the supplied material and cannot be converted into a deployable signature here.

### Telegram operation

The HookBot-only `asp.net/TelegramInjectionBot` application runs six workers:

- `InjectionToTelegramWorker`
- `CheckNewBotLogsWorker`
- `CheckOfflineBotsWorker`
- `HandleTelegramMessagesWorker`
- `SendUserAuthorizationCodesToTelegramWorker`
- `SendNewMessagesWorker`

These workers forward injection sessions, stolen data, authorization codes and SMS; monitor bot availability; and process operator commands.

### Targeting and infrastructure scale

The leaked panel includes 484 prepared overlays covering more than 40 countries. Named targets include PayPay, Rakuten, SMBC, Coincheck, Bradesco Next, Intermedium, Modalmais, Original, Akbank, Garanti, Yapi Kredi, QNB Finansbank and more than 30 cryptocurrency wallets, including MetaMask, Trust Wallet, Coinbase, Binance, Samourai, Mycelium and SafePal. These entries show targeting intent, not victimisation; the recovered victim-record tables were empty.

Censys observed 266 distinct HookBot-labelled IP addresses and 55 ERMAC-labelled addresses over the year to publication. HookBot peaked at 58 active hosts in September 2025, fell to six in June 2026 and rose to 16 in August. These figures count panels observed during scans, not infected devices. Censys attributes part of the apparent decline to operators enabling the IP gate, meaning disappearance from passive scans does not demonstrate takedown.

### Attribution caveat

Censys relays reporting that associates the handles `DukeEugene` and `RedDragon` with Hook development and sales. No MITRE actor profile is present in the supplied verified reference data; attribution to either handle is therefore **unconfirmed**. The source leak also allows unrelated operators to deploy identical infrastructure, so panel artefacts cannot attribute a deployment to the original developers. A recovered post-leak deployment contained a Node.js relay with Chinese comments over the Russian-authored base, further indicating reuse by another operator, but that observation remains single-sourced.

## 4\. Mitigation & containment

There is no vendor patch or version upgrade associated with this item. Remediation consists of mobile-device containment, malicious-application removal or device rebuild, credential and session invalidation, fraud review and policy enforcement.

### P1 — within 24 hours

1. **Validate and contain matched devices.** Quarantine managed Android devices matching the supplied APK hashes or showing an unexplained side-loaded application with accessibility access. Preserve the APK and relevant mobile telemetry before removal. Rebuild or re-enrol the device if integrity cannot be established.
2. **Revoke malicious accessibility access.** Remove accessibility permission from unapproved applications. Do not rely on the displayed launcher identity: HookBot can present one of 20 legitimate-brand aliases.
3. **Contain affected identities.** From a known-clean device, reset exposed banking credentials, revoke active sessions and trusted-device registrations, and review recent authentication and payment activity. Treat SMS confirmation codes observed on an infected device as compromised.
4. **Control the supplied indicators.** Search DNS, proxy, firewall, mobile-threat-defence and EDR telemetry for the §5 domains, IP addresses and hashes. Block confirmed matches at the appropriate control point. The set is single-sourced and includes historical, rotated, Cloudflare-fronted and repurposed infrastructure; verify ownership and current resolution before permanent enforcement.
5. **Hunt relevant outbound services.** Investigate mobile or user-segment traffic to unusual external services on TCP `8000`, `8088`, `8089`, `3434`, `50000` and `50555`. Do not block common ports such as TCP `80` globally.

### P2 — within 72 hours

1. **Restrict side-loading.** Enforce managed-application installation and prevent installation from unknown sources where business requirements permit.
2. **Restrict accessibility grants.** Configure mobile-management controls to prevent unmanaged or newly installed applications from receiving accessibility access. Alert on unexpected changes for devices used to access banking, payment or administrative applications.
3. **Review account-takeover exposure.** Correlate suspicious mobile-device activity with new-device enrolment, password resets, SMS-based authentication, beneficiary creation and anomalous payments. Escalate matching accounts for fraud review.
4. **Inspect possible server-side deployment.** If internal or hosted assets expose the identified container names, ports, `/api/v1/`, `/mssql/`, `PROTECTED AREA` response or Telegram worker names, isolate the host, preserve container images and volumes, and rotate any credentials or keys stored in `.env`, MySQL or deployment configuration.
5. **Deploy and test §6 detections.** Map the Sigma fields to available proxy telemetry and apply the YARA rule only to unpacked server-side material. Use the supplied hashes for APK detection because per-build obfuscation limits reusable string signatures.

### P3 — within seven days

1. Update mobile-security guidance to address fake application updates, direct APK links, brand impersonation and accessibility-permission requests.
2. Exercise an account-takeover response covering infected-device isolation, clean-channel credential reset, session invalidation and retrospective transaction review.
3. Monitor external exposure for builder port `8088` and the security-gate response on `50000`. Treat panel titles, favicons and `hook_session` cookies as supporting evidence rather than standalone attribution.
4. Review controls around SMS-based confirmation for high-risk transactions and apply stronger step-up verification where supported by existing client policy.

## 5\. Indicators of compromise

All indicators below are **single-sourced to Censys; verify before enforcement**. Several represent historical associations and may now be inactive, gated, rotated or repurposed.

| type     | value                                                            | confidence                                                                      | source                                                                      |
| -------- | ---------------------------------------------------------------- | ------------------------------------------------------------------------------- | --------------------------------------------------------------------------- |
| domain   | havijmail\[.\]com                                                | Medium; single observation on 2026-08-15                                        | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| domain   | www.racon\[.\]online                                             | Medium; single observation on 2026-08-16                                        | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| domain   | vps-d798fb0f.vps.ovh\[.\]net                                     | Medium; single observation on 2026-08-08                                        | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| domain   | orapopo\[.\]store                                                | Medium historical; label absent by 2026-08-17                                   | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| domain   | ces.yeyr\[.\]lol                                                 | Medium historical; observed through 2026-05-11                                  | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| domain   | errr.onllee\[.\]com                                              | Medium historical; observed through 2026-05-15                                  | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| ipv4     | 77.73.135\[.\]34                                                 | Medium; builder reported live at publication                                    | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| ipv4     | 82.158.90\[.\]131                                                | Medium; observed through 2026-08-19                                             | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| ipv4     | 82.158.90\[.\]133                                                | Medium; observed through 2026-08-18                                             | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| ipv4     | 82.158.90\[.\]134                                                | Medium; observed through 2026-08-19                                             | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| ipv4     | 118.107.45\[.\]29                                                | Medium historical; subsequently gated                                           | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| ipv4     | 118.107.45\[.\]70                                                | Medium historical; subsequently gated                                           | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| ipv4     | 118.107.45\[.\]73                                                | Medium historical; subsequently gated                                           | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| ipv4     | 51.38.113\[.\]113                                                | Medium; single observation on 2026-08-08                                        | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| ipv4     | 137.220.219\[.\]244                                              | Medium historical; observed through 2026-05-11                                  | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| ipv4     | 185.99.255\[.\]17                                                | Medium historical; panel absent after 2026-07-23                                | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| ipv4     | 103.118.199\[.\]85                                               | Low; reported C2, no service indexed by Censys                                  | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| ipv4     | 212.193.23\[.\]223                                               | Low; reported C2, no service indexed by Censys                                  | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| ipv4     | 93.127.141\[.\]93                                                | Low for current activity; reported as rotated off                               | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| ipv4     | 62.169.31\[.\]177                                                | Low for current activity; reported as rotated off                               | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| ipv4     | 118.107.5\[.\]135                                                | Low for current activity; subsequently repurposed                               | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| ipv4     | 45.207.206\[.\]169                                               | Medium historical; open directory observed through 2026-06-20                   | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| md5      | 0452650b0b1e7eeaf01bd74e927a4dd7                                 | Medium-high historical; ERMAC favicon, single-sourced zero-benign-match claim   | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| md5      | 90a61dcc76d704b2e861a0465ced2f87                                 | Medium-high historical; HookBot favicon, single-sourced zero-benign-match claim | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| filename | ermac\_built\_20260609\_230202.apk                               | Medium; recovered but not executed                                              | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| filename | ermac\_built\_20260609\_230453.apk                               | Medium; recovered but not executed                                              | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| sha256   | 54536eda036ae8d15baba8e6f7236a5a895e49fe4fe00413cf8e61ffe9ec8353 | Medium; first dated build, recovered but not executed                           | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| sha256   | 3991246a9f124baef285f53fa1bf63f325bcf2f16a5ef02dd055349caf5b1dab | Medium; second dated build, recovered but not executed                          | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| sha256   | a8b0ee73d386fe7dbd9be196197421cd87a0672a20b34fc7bbaf2c6016b2f5f6 | Medium; unsigned base APK                                                       | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| sha256   | 8f2b1ddb2cbe98ddeb92a14434da8ad5076a72a5491a80d87fd037f2d74d73af | Medium; signed build v2                                                         | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| sha256   | 6a2cada709868f96a488b1167270c04d771a52adb3cc538d683d6cdf1dc3d7a0 | Medium; signed build v3                                                         | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| sha256   | b75bb1b99e0157cbc5ea7d3e6cfec967c9b2466f1d24403e95be7608869b5ce4 | Medium; signed build v4                                                         | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| sha256   | 96411de04d2511f35481d5803aa6bfb2d9fc48c17c0362ef7d9f429837b35b1f | Medium; signed build v5                                                         | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| sha256   | ef56aba60776990fd585b0a853588eb141a71ebd496adbea495c96b08a2746d2 | Medium; signed build v6                                                         | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| sha256   | 6c3c7e9d2d2b180f40e8effc5c2de58744d8502c2336c197cb3f2f2e094766ab | Medium; signed build v7                                                         | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| sha256   | 10cdbf95c65e1ac64ba341551c7524f0153d4aa6e3df1cc66a629b5f65f6a56c | Medium; signed build v8                                                         | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |
| sha256   | f6ae6018366457ee74eba8d14c164a35d4d57b93e1f346455a4b771e8ab46e07 | Medium; signed build v9                                                         | [Censys](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk) |

```iocs
domain  havijmail[.]com
domain  www.racon[.]online
domain  vps-d798fb0f.vps.ovh[.]net
domain  orapopo[.]store
domain  ces.yeyr[.]lol
domain  errr.onllee[.]com
ipv4  77.73.135[.]34
ipv4  82.158.90[.]131
ipv4  82.158.90[.]133
ipv4  82.158.90[.]134
ipv4  118.107.45[.]29
ipv4  118.107.45[.]70
ipv4  118.107.45[.]73
ipv4  51.38.113[.]113
ipv4  137.220.219[.]244
ipv4  185.99.255[.]17
ipv4  103.118.199[.]85
ipv4  212.193.23[.]223
ipv4  93.127.141[.]93
ipv4  62.169.31[.]177
ipv4  118.107.5[.]135
ipv4  45.207.206[.]169
md5  0452650b0b1e7eeaf01bd74e927a4dd7
md5  90a61dcc76d704b2e861a0465ced2f87
filename  ermac_built_20260609_230202.apk
filename  ermac_built_20260609_230453.apk
sha256  54536eda036ae8d15baba8e6f7236a5a895e49fe4fe00413cf8e61ffe9ec8353
sha256  3991246a9f124baef285f53fa1bf63f325bcf2f16a5ef02dd055349caf5b1dab
sha256  a8b0ee73d386fe7dbd9be196197421cd87a0672a20b34fc7bbaf2c6016b2f5f6
sha256  8f2b1ddb2cbe98ddeb92a14434da8ad5076a72a5491a80d87fd037f2d74d73af
sha256  6a2cada709868f96a488b1167270c04d771a52adb3cc538d683d6cdf1dc3d7a0
sha256  b75bb1b99e0157cbc5ea7d3e6cfec967c9b2466f1d24403e95be7608869b5ce4
sha256  96411de04d2511f35481d5803aa6bfb2d9fc48c17c0362ef7d9f429837b35b1f
sha256  ef56aba60776990fd585b0a853588eb141a71ebd496adbea495c96b08a2746d2
sha256  6c3c7e9d2d2b180f40e8effc5c2de58744d8502c2336c197cb3f2f2e094766ab
sha256  10cdbf95c65e1ac64ba341551c7524f0153d4aa6e3df1cc66a629b5f65f6a56c
sha256  f6ae6018366457ee74eba8d14c164a35d4d57b93e1f346455a4b771e8ab46e07

```

### Behavioural indicators

| behaviour                                                                                                                | where to observe                                               | confidence                                                        |
| ------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------- | ----------------------------------------------------------------- |
| Side-loaded APK requests accessibility access and overlays a targeted banking or wallet application shortly after launch | MDM, mobile-threat-defence and accessibility-service telemetry | Medium; single-sourced                                            |
| Base64 POST structure carrying an AES-128-CBC-encrypted body                                                             | Proxy, network-sensor or captured implant traffic              | Medium; protocol may be difficult to inspect                      |
| External connections to 8000, 8088, 8089, 3434, 50000 or 50555                                                           | Firewall, proxy, DNS and network-flow logs                     | Low alone; require supporting artefacts                           |
| HTTP 401 response containing PROTECTED AREA on TCP 50000                                                                 | Proxy response-body or active-service telemetry                | Medium-high; single-sourced precision claim                       |
| Set-Cookie header beginning with hook\_session=                                                                          | Proxy or HTTP telemetry                                        | Medium only when combined with a second panel artefact            |
| workerman/4.1.9 banner                                                                                                   | Service inventory or network telemetry                         | Low; Censys found 91 internet-wide hosts                          |
| WebSocket 426 Upgrade Required response or server-initiated ping every 30 seconds                                        | WebSocket-aware network telemetry                              | Low; generic without supporting infrastructure evidence           |
| Exposed builder on 8088 with 13 co-occurring ch\_\* flags                                                                | External attack-surface monitoring                             | High in source assessment, but individual flags were not supplied |

## 6\. Detection

The YARA rule targets unpacked HookBot/ERMAC server-side components. It is not intended to detect obfuscated implant APKs; use the supplied SHA-256 values for those files. All rule inputs are single-sourced and require validation.

```yara
rule AT_HookBot_Server_Components_20260825
{
    meta:
        author = "Adverse Trace"
        date = "2026-08-25"
        reference = "https://censys.com/blog/ermac-source-leak-hookbot/"
        description = "Detects co-occurring HookBot Telegram worker or IP-whitelist security-gate artefacts"

    strings:
        $telegram_path = "asp.net/TelegramInjectionBot" ascii wide

        $worker_1 = "InjectionToTelegramWorker" ascii wide
        $worker_2 = "CheckNewBotLogsWorker" ascii wide
        $worker_3 = "CheckOfflineBotsWorker" ascii wide
        $worker_4 = "HandleTelegramMessagesWorker" ascii wide
        $worker_5 = "SendUserAuthorizationCodesToTelegramWorker" ascii wide
        $worker_6 = "SendNewMessagesWorker" ascii wide

        $ipset_add = "ipset add whitelist" ascii wide
        $firewall_80 = "--dport 80 -j DROP" ascii wide
        $firewall_8089 = "--dport 8089 -j DROP" ascii wide
        $firewall_8000 = "--dport 8000 -j DROP" ascii wide

    condition:
        (4 of ($worker_*)) or
        ($telegram_path and 2 of ($worker_*)) or
        ($ipset_add and all of ($firewall_*))
}

```

The following Sigma rule requires proxy telemetry that records destination ports, HTTP status and response bodies. Field names may require local mapping.

```yaml
title: HookBot Security Gate HTTP 401 Response
status: experimental
description: Detects the distinctive response returned by the HookBot IP-whitelist security gate.
author: Adverse Trace
date: 2026-08-25
references:

  - https://censys.com/blog/ermac-source-leak-hookbot/
logsource:
  category: proxy
detection:
  selection:
    DestinationPort: 50000
    HttpStatus: 401
    ResponseBody|contains: 'PROTECTED AREA'
  condition: selection
falsepositives:

  - Unrelated applications using the same response text and port
level: medium

```

## 7\. Sources

- Censys, “[What the ERMAC Source Leak Says About HookBot](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk),” 2026-08-25\. The supplied related source is a duplicate extract of this report and is not independent corroboration.

## 8\. Adverse Trace position

Adverse Trace assigns no formal vulnerability severity: the verified reference data resolves no CVE, CVSS score, severity rating or CISA KEV exploitation state. We assess the client-impact potential as material because the malware supports credential and confirmation-code theft, remote device control and account takeover against banking and cryptocurrency applications, including EMEA targets; however, the overlay list demonstrates targeting intent rather than victimisation, and no client compromise is established. Human attribution to `DukeEugene` or `RedDragon` is unconfirmed because no MITRE profile is present in the verified data, while the source leak permits unrelated operators to deploy the same artefacts. The technical findings and IOC set are single-sourced; verify before enforcement. Adverse Trace will prioritise monitoring of builder exposure, validate newly observed infrastructure against multiple artefacts and update clients if independent corroboration, victim evidence or material changes to the campaign emerge.

---

[Read the original source →](https://censys.com/blog/ermac-source-leak-hookbot/?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*