ERMAC

ERMAC is an Android banking trojan active in the mobile threat landscape and commonly referenced as Android.BankBot.Ermac. It was first observed in the wild in September 2022. Reporting in the provided content describes ERMAC as a malware family used for banking fraud on Android devices and notes that Hook descends from the ERMAC family and was built from ERMAC source code, with Hook adding substantial new functionality. NCC Group also reported that Hook and ERMAC were advertised by the threat actor DukeEugene. ThreatFabric reporting cited in the content links the mobile threat actor "sybra" to operation of an ERMAC fork named MetaDroid.

The content indicates ERMAC has undergone multiple versions, including ERMAC 3.0, and that the ERMAC v3 source code leaked online. The leak reportedly included not only the trojan source code but also its builder, backend, and exfiltration servers, creating attribution and infrastructure-analysis opportunities. The content does not provide a full native capability list for ERMAC itself, but its classification as an Android banking trojan is explicit, and its family relationship to Hook places it in the ecosystem of Android malware used for credential theft and financial fraud.

High-confidence indicators and references directly mentioned in the content include the malware names/aliases ERMAC, Android.BankBot.Ermac, and Android.BankBot.Ermac.6.origin; the ERMAC fork MetaDroid; and repeated references to the ERMAC v3.0 source code leak. Associated actors directly mentioned are DukeEugene, which advertised ERMAC and Hook, and sybra, which was observed operating the ERMAC fork MetaDroid.