What the ERMAC Source Leak Says About HookBot

1. Executive summary

Censys reports that the August 2025 publication of ERMAC 3.0 source code exposed a deployable Android banking-trojan stack comprising the implant builder, Laravel backend, React panel, WebSocket relay and Obfuscapk tooling. ERMAC and HookBot share the same code lineage; operators use side-loaded Android applications, accessibility permissions and app-specific overlays to steal credentials and confirmation codes, with HookBot additionally supporting VNC control, file management, WhatsApp propagation and Telegram-based operation. EMEA financial institutions are exposed through impersonation and account-takeover risk: the supplied configuration includes overlays for Turkish banks, earlier Polish campaigns and broader targeting of Turkey, Spain, Poland, Portugal and cryptocurrency services, but it contains no victim data and does not establish compromise of any client. The supplied verified reference data resolves no CVE, CVSS score, severity rating or CISA KEV exploitation state for this item; all substantive findings and indicators are single-sourced to Censys and should be verified before enforcement.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The source also establishes no client incident, material service disruption or affected OES/RDSP service that would create an item-specific UK NIS 2018 mapping; obligations should be reassessed if client telemetry confirms credential theft, fraudulent transactions or service impact.

3. Technical analysis & attack chain

The following chain is confirmed within the supplied Censys material but is not independently corroborated. The related-source extract duplicates the primary source and does not constitute a second source. Infrastructure, prevalence and attribution claims are therefore single-sourced; verify before enforcement. Censys

1. Delivery and user-assisted installation. Operators distribute implant APKs outside Google Play through fake update pages, direct APK links, GitHub file hosting and Telegram channels. Hook can also use the openwhatsapp command to send a lure from an infected device’s WhatsApp account. The recipient must still open the link, approve side-loading and grant Android accessibility permissions.
2. Disguise and execution. HookBot’s manifest contains 20 activity aliases from which an operator can select a launcher identity. Supplied labels and icons impersonate Chrome, WhatsApp, Instagram, Telegram, TikTok, Facebook, Gmail, Google Play, YouTube and Contacts.
3. Accessibility abuse and overlay theft. Once accessibility access is granted, the implant can observe screens and interact with applications. When a targeted banking or wallet application opens, the implant places a prepared imitation login screen over the legitimate application approximately half a second later. Credentials entered into the overlay are sent to the operator.
4. Authentication-code interception and exfiltration. The implant intercepts SMS and other stolen data, including confirmation codes. ERMAC 3.0 and HookBot retain a base64-encoded POST structure with an encrypted request body and request-type switch inherited from Cerberus; the server-side cipher changed from Cerberus’ RC4 to AES-128-CBC.
5. Command-and-control and operator access. The panel lists infected devices, stores logs and injection records, holds the overlay library and issues commands. The Docker stack exposes a Laravel API, Workerman implant socket, WebSocket relay and APK builder. Hook’s command set grew from ERMAC’s 30 commands to 58 in Hook v1 and 68 in v2, adding VNC remote-screen control, a file manager, WhatsApp manipulation and propagation.
6. Operational use and impact. HookBot’s ASP.NET Telegram application can deliver stolen credentials, intercepted SMS and authorization codes to the operator and accept commands through Telegram. The resulting risk is account takeover and payment or wallet fraud. The supplied data contains no confirmed victims, losses or client compromises.

Vulnerability and platform status

This chain does not depend on a reported CVE. Initial access requires social engineering, side-loading and user approval of accessibility access. The supplied verified reference data resolves no CVE, CVSS severity or CISA KEV exploitation state.

The source describes no Android privilege-escalation mechanism or implant persistence method. Accessibility access gives the implant extensive control without establishing that it gains root privileges. No enterprise-network lateral movement is reported; openwhatsapp is contact-based propagation from an infected device rather than network lateral movement.

Code lineage and leaked components

The published material comprised:

• Laravel 10 backend running PHP 8.1 with Eloquent, JWT and Sanctum.
• React and TypeScript operator panel.
• WebSocket relay.
• APK builder using Obfuscapk and apktool.
• Docker Compose deployment configuration.
• MySQL 8.0 datastore.
• HookBot-only IP-whitelist security gate and ASP.NET Telegram application.

Censys reports direct structural correspondence between Cerberus request objects and ERMAC controller methods, including:

ERMAC 3.0 and HookBot also share 21 database migrations with matching timestamps. A panelName constant contains ERMAC in one tree and Hook in the other, allowing trivial rebranding. ERMAC 3.0 retains Hook-named directories and differs principally through the panel-name change, removed Telegram routes and a relay rewrite.

The inherited configuration includes admin credentials seeded through DatabaseSeeder.php. ERMAC 3.0 and HookBot also share an AES key and initialization vector carried unchanged from .env.example; recovered deployments retained shipped values. HookBot source additionally contains Telegram bot tokens and a MySQL root password. Those secrets are deliberately excluded from this advisory.

Server architecture and exposed services

The source repeatedly identifies 8088 as the builder and 8000 as the Workerman socket. One sentence incorrectly describes 8000 as the builder port; the supplied port table, Docker mapping and firewall analysis consistently place the builder on 8088.

Protected Laravel routes are under /api/v1/ and use auth:sanctum. The smart-injection route group is declared as a sibling of the protected middleware group, allowing unauthenticated callers to read and write injection-session records. No CVE or formal severity is assigned to this design exposure.

HookBot security gate

HookBot’s security/ component creates an ipset allowlist and inserts the following rules into DOCKER-USER:

iptables -I DOCKER-USER -i ens3 -m set ! --match-set whitelist src -p tcp --dport 80 -j DROP
iptables -I DOCKER-USER -i ens3 -m set ! --match-set whitelist src -p tcp --dport 8089 -j DROP
iptables -I DOCKER-USER -i ens3 -m set ! --match-set whitelist src -p tcp --dport 8000 -j DROP

An Express service on TCP 50000 uses HTTP Basic authentication. Successful authentication runs ipset add whitelist <ip> and schedules removal after 12 hours. Unauthorized requests return PROTECTED AREA with HTTP status 401.

The supplied rules hide the panel, API and Workerman implant socket but do not cover builder port 8088. This makes the builder a more durable discovery point than panel titles or favicons. Censys states that the builder exposes 13 co-occurring ch_* Obfuscapk flags whose renaming would break the build pipeline, but the individual flag strings are absent from the supplied material and cannot be converted into a deployable signature here.

Telegram operation

The HookBot-only asp.net/TelegramInjectionBot application runs six workers:

• InjectionToTelegramWorker
• CheckNewBotLogsWorker
• CheckOfflineBotsWorker
• HandleTelegramMessagesWorker
• SendUserAuthorizationCodesToTelegramWorker
• SendNewMessagesWorker

These workers forward injection sessions, stolen data, authorization codes and SMS; monitor bot availability; and process operator commands.

Targeting and infrastructure scale

The leaked panel includes 484 prepared overlays covering more than 40 countries. Named targets include PayPay, Rakuten, SMBC, Coincheck, Bradesco Next, Intermedium, Modalmais, Original, Akbank, Garanti, Yapi Kredi, QNB Finansbank and more than 30 cryptocurrency wallets, including MetaMask, Trust Wallet, Coinbase, Binance, Samourai, Mycelium and SafePal. These entries show targeting intent, not victimisation; the recovered victim-record tables were empty.

Censys observed 266 distinct HookBot-labelled IP addresses and 55 ERMAC-labelled addresses over the year to publication. HookBot peaked at 58 active hosts in September 2025, fell to six in June 2026 and rose to 16 in August. These figures count panels observed during scans, not infected devices. Censys attributes part of the apparent decline to operators enabling the IP gate, meaning disappearance from passive scans does not demonstrate takedown.

Attribution caveat

Censys relays reporting that associates the handles DukeEugene and RedDragon with Hook development and sales. No MITRE actor profile is present in the supplied verified reference data; attribution to either handle is therefore unconfirmed. The source leak also allows unrelated operators to deploy identical infrastructure, so panel artefacts cannot attribute a deployment to the original developers. A recovered post-leak deployment contained a Node.js relay with Chinese comments over the Russian-authored base, further indicating reuse by another operator, but that observation remains single-sourced.

4. Mitigation & containment

There is no vendor patch or version upgrade associated with this item. Remediation consists of mobile-device containment, malicious-application removal or device rebuild, credential and session invalidation, fraud review and policy enforcement.

P1 — within 24 hours

1. Validate and contain matched devices. Quarantine managed Android devices matching the supplied APK hashes or showing an unexplained side-loaded application with accessibility access. Preserve the APK and relevant mobile telemetry before removal. Rebuild or re-enrol the device if integrity cannot be established.
2. Revoke malicious accessibility access. Remove accessibility permission from unapproved applications. Do not rely on the displayed launcher identity: HookBot can present one of 20 legitimate-brand aliases.
3. Contain affected identities. From a known-clean device, reset exposed banking credentials, revoke active sessions and trusted-device registrations, and review recent authentication and payment activity. Treat SMS confirmation codes observed on an infected device as compromised.
4. Control the supplied indicators. Search DNS, proxy, firewall, mobile-threat-defence and EDR telemetry for the §5 domains, IP addresses and hashes. Block confirmed matches at the appropriate control point. The set is single-sourced and includes historical, rotated, Cloudflare-fronted and repurposed infrastructure; verify ownership and current resolution before permanent enforcement.
5. Hunt relevant outbound services. Investigate mobile or user-segment traffic to unusual external services on TCP 8000, 8088, 8089, 3434, 50000 and 50555. Do not block common ports such as TCP 80 globally.

P2 — within 72 hours

1. Restrict side-loading. Enforce managed-application installation and prevent installation from unknown sources where business requirements permit.
2. Restrict accessibility grants. Configure mobile-management controls to prevent unmanaged or newly installed applications from receiving accessibility access. Alert on unexpected changes for devices used to access banking, payment or administrative applications.
3. Review account-takeover exposure. Correlate suspicious mobile-device activity with new-device enrolment, password resets, SMS-based authentication, beneficiary creation and anomalous payments. Escalate matching accounts for fraud review.
4. Inspect possible server-side deployment. If internal or hosted assets expose the identified container names, ports, /api/v1/, /mssql/, PROTECTED AREA response or Telegram worker names, isolate the host, preserve container images and volumes, and rotate any credentials or keys stored in .env, MySQL or deployment configuration.
5. Deploy and test §6 detections. Map the Sigma fields to available proxy telemetry and apply the YARA rule only to unpacked server-side material. Use the supplied hashes for APK detection because per-build obfuscation limits reusable string signatures.

P3 — within seven days

1. Update mobile-security guidance to address fake application updates, direct APK links, brand impersonation and accessibility-permission requests.
2. Exercise an account-takeover response covering infected-device isolation, clean-channel credential reset, session invalidation and retrospective transaction review.
3. Monitor external exposure for builder port 8088 and the security-gate response on 50000. Treat panel titles, favicons and hook_session cookies as supporting evidence rather than standalone attribution.
4. Review controls around SMS-based confirmation for high-risk transactions and apply stronger step-up verification where supported by existing client policy.

5. Indicators of compromise

All indicators below are single-sourced to Censys; verify before enforcement. Several represent historical associations and may now be inactive, gated, rotated or repurposed.

domain  havijmail[.]com
domain  www.racon[.]online
domain  vps-d798fb0f.vps.ovh[.]net
domain  orapopo[.]store
domain  ces.yeyr[.]lol
domain  errr.onllee[.]com
ipv4  77.73.135[.]34
ipv4  82.158.90[.]131
ipv4  82.158.90[.]133
ipv4  82.158.90[.]134
ipv4  118.107.45[.]29
ipv4  118.107.45[.]70
ipv4  118.107.45[.]73
ipv4  51.38.113[.]113
ipv4  137.220.219[.]244
ipv4  185.99.255[.]17
ipv4  103.118.199[.]85
ipv4  212.193.23[.]223
ipv4  93.127.141[.]93
ipv4  62.169.31[.]177
ipv4  118.107.5[.]135
ipv4  45.207.206[.]169
md5  0452650b0b1e7eeaf01bd74e927a4dd7
md5  90a61dcc76d704b2e861a0465ced2f87
filename  ermac_built_20260609_230202.apk
filename  ermac_built_20260609_230453.apk
sha256  54536eda036ae8d15baba8e6f7236a5a895e49fe4fe00413cf8e61ffe9ec8353
sha256  3991246a9f124baef285f53fa1bf63f325bcf2f16a5ef02dd055349caf5b1dab
sha256  a8b0ee73d386fe7dbd9be196197421cd87a0672a20b34fc7bbaf2c6016b2f5f6
sha256  8f2b1ddb2cbe98ddeb92a14434da8ad5076a72a5491a80d87fd037f2d74d73af
sha256  6a2cada709868f96a488b1167270c04d771a52adb3cc538d683d6cdf1dc3d7a0
sha256  b75bb1b99e0157cbc5ea7d3e6cfec967c9b2466f1d24403e95be7608869b5ce4
sha256  96411de04d2511f35481d5803aa6bfb2d9fc48c17c0362ef7d9f429837b35b1f
sha256  ef56aba60776990fd585b0a853588eb141a71ebd496adbea495c96b08a2746d2
sha256  6c3c7e9d2d2b180f40e8effc5c2de58744d8502c2336c197cb3f2f2e094766ab
sha256  10cdbf95c65e1ac64ba341551c7524f0153d4aa6e3df1cc66a629b5f65f6a56c
sha256  f6ae6018366457ee74eba8d14c164a35d4d57b93e1f346455a4b771e8ab46e07

Behavioural indicators

6. Detection

The YARA rule targets unpacked HookBot/ERMAC server-side components. It is not intended to detect obfuscated implant APKs; use the supplied SHA-256 values for those files. All rule inputs are single-sourced and require validation.

rule AT_HookBot_Server_Components_20260825
{
    meta:
        author = "Adverse Trace"
        date = "2026-08-25"
        reference = "https://censys.com/blog/ermac-source-leak-hookbot/"
        description = "Detects co-occurring HookBot Telegram worker or IP-whitelist security-gate artefacts"

    strings:
        $telegram_path = "asp.net/TelegramInjectionBot" ascii wide

        $worker_1 = "InjectionToTelegramWorker" ascii wide
        $worker_2 = "CheckNewBotLogsWorker" ascii wide
        $worker_3 = "CheckOfflineBotsWorker" ascii wide
        $worker_4 = "HandleTelegramMessagesWorker" ascii wide
        $worker_5 = "SendUserAuthorizationCodesToTelegramWorker" ascii wide
        $worker_6 = "SendNewMessagesWorker" ascii wide

        $ipset_add = "ipset add whitelist" ascii wide
        $firewall_80 = "--dport 80 -j DROP" ascii wide
        $firewall_8089 = "--dport 8089 -j DROP" ascii wide
        $firewall_8000 = "--dport 8000 -j DROP" ascii wide

    condition:
        (4 of ($worker_*)) or
        ($telegram_path and 2 of ($worker_*)) or
        ($ipset_add and all of ($firewall_*))
}

The following Sigma rule requires proxy telemetry that records destination ports, HTTP status and response bodies. Field names may require local mapping.

title: HookBot Security Gate HTTP 401 Response
status: experimental
description: Detects the distinctive response returned by the HookBot IP-whitelist security gate.
author: Adverse Trace
date: 2026-08-25
references:

  - https://censys.com/blog/ermac-source-leak-hookbot/
logsource:
  category: proxy
detection:
  selection:
    DestinationPort: 50000
    HttpStatus: 401
    ResponseBody|contains: 'PROTECTED AREA'
  condition: selection
falsepositives:

  - Unrelated applications using the same response text and port
level: medium

7. Sources

• Censys, “What the ERMAC Source Leak Says About HookBot,” 2026-08-25. The supplied related source is a duplicate extract of this report and is not independent corroboration.

8. Adverse Trace position

Adverse Trace assigns no formal vulnerability severity: the verified reference data resolves no CVE, CVSS score, severity rating or CISA KEV exploitation state. We assess the client-impact potential as material because the malware supports credential and confirmation-code theft, remote device control and account takeover against banking and cryptocurrency applications, including EMEA targets; however, the overlay list demonstrates targeting intent rather than victimisation, and no client compromise is established. Human attribution to DukeEugene or RedDragon is unconfirmed because no MITRE profile is present in the verified data, while the source leak permits unrelated operators to deploy the same artefacts. The technical findings and IOC set are single-sourced; verify before enforcement. Adverse Trace will prioritise monitoring of builder exposure, validate newly observed infrastructure against multiple artefacts and update clients if independent corroboration, victim evidence or material changes to the campaign emerge.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.