Banking Trojan ERMAC V3.0 Source Code Leak Reveals Comprehensive Malware Infrastructure

Aug 16, 2025Ravie lakshmananAndroid / Malware

Cybersecurity researchers have detailed the inner workings of an Android banking trojan called ERMAC 3.0, uncovering serious shortcomings in the operators’ infrastructure.

“The newly uncovered version 3.0 reveals a significant evolution of the malware, expanding its form injection and data theft capabilities to target more than 700 banking, shopping, and cryptocurrency applications,” Hunt.io said in a report.

Ermac what first documented by ThreatFabric in September 2021, detailing its ability to conduct overlay attacks against hundreds of banking and cryptocurrency apps across the world. Attributed to a threat actor named DukeEugene, it’s assessed to be an evolution of Cerberus and BlackRock.

Other commonly observed malware families – including Hook (ERMAC 2.0), Pegasus, and Loot – possess a shared lineage: An ancestor in the form of ERMAC from which source code components have been passed down and modified through generations.

Hunt.io said it managed to obtain the complete source code associated with the malware-as-a-service (MaaS) offering from an open directory on 141.164.62[.]236:443, right down to its PHP and Laravel backend, React-based frontend, Golang exfiltration server, and Android builder panel.

The functions of each of the components are listed below –

• Backend C2 server – Provides operators the ability to manage victim devices and access compromised data, such as SMS logs, stolen accounts, and device data
• Frontend panel – Allows operators to interact with connected devices by issuing commands, managing overlays, and accessing stolen data
• Exfiltration server – A Golang server used for exfiltrating stolen data and managing information related to compromised devices
• ERMAC backdoor – An Android implant written in Kotlin that offers the ability to control the compromised device and collect sensitive data based on incoming commands from the C2 server, while ensuring that the infections don’t touch devices located in the Commonwealth of Independent States (CIS) nations
• ERMAC builder – A tool to help customers configure and create builds for their malware campaigns by providing the application name, server URL, and other settings for the Android backdoor

Besides an expanded set of app targets, ERMAC 3.0 adds new form injection methods, an overhauled command-and-control (C2) panel, a new Android backdoor, and AES-CBC encrypted communications.

“The leak revealed critical weaknesses, such as a hardcoded JWT secret and a static admin bearer token, default root credentials, and open account registration on the admin panel,” the company said. “By correlating these flaws with live ERMAC infrastructure, we provide defenders with concrete ways to track, detect, and disrupt active operations.”

Banking Trojan ERMAC V3.0 Source Code Leak Reveals Extensive Malware Infrastructure

“`html

The cyber security landscape recently experienced a notable upheaval with the leak of the source code for the ERMAC V3.0 banking Trojan. This leak provides unparalleled insight into the inner workings of a refined piece of malware,perhaps empowering both security researchers and malicious actors. Let’s dissect the implications of this leak, examining the ERMAC V3.0’s capabilities, its infrastructure, and the potential ramifications for internet users.Our focus will be on understanding the threat, the attack vectors, and strategies to mitigate the risks associated with this potent malware.

ERMAC V3.0: A Deep Dive Into the Malware

ERMAC, known for targeting Android devices, is a sophisticated banking Trojan designed to harvest financial credentials, intercept SMS messages, and perform a range of malicious activities. The leaked source code of ERMAC V3.0 allows security professionals to deconstruct the trojan’s architecture, identify vulnerabilities, and develop countermeasures.

Key Capabilities of ERMAC V3.0:

• Credential Theft: ERMAC V3.0 is primarily designed to steal banking credentials, login details for various online services, and sensitive personal details.
• SMS Interception: The malware can intercept and read SMS messages. This is especially dangerous as it can be used to steal one-time passwords (otps) used for two-factor authentication.
• remote Control: ERMAC V3.0 allows attackers to remotely control infected devices. This enables them to perform a wide array of malicious actions, including installing additional malware, executing commands, and exfiltrating data.
• Overlay Attacks: The Trojan employs overlay attacks, displaying fake login screens over legitimate banking and financial applications to trick users into entering thier credentials.
• Contact Harvesting: Extracts and uses a victim’s saved contacts to send phishing messages to other victims.

Analyzing the Malware Infrastructure

Understanding the infrastructure that supports ERMAC V3.0 is crucial for both prevention and response strategies. The source code leak allows a more in-depth look at the elements that help the malware operate,which include command and control (C&C) servers,communication protocols,and update mechanisms.

Components of the ERMAC V3.0 Infrastructure:

• Command and Control (C&C) Servers: These servers act as the central hub for controlling infected devices.The leaked code provides information on how these servers are set up, the protocols used for communication, and their locations.
• Communication protocols: The malware commonly uses HTTP and other secure protocols to communicate with the C&C servers. Analysis of the code reveals encryption methods and communication patterns used to evade detection.
• Update Mechanisms: ERMAC V3.0 includes an update system that allows attackers to remotely update the malware with new features or modifications. Understanding this mechanism helps in identifying and blocking update requests that could lead to new attacks.
• Distribution Methods: The source code offers insights into how ERMAC V3.0 is distributed. This includes methods such as malicious apps masquerading as legitimate applications and phishing emails with malicious attachments or links that, when clicked, initiate the installation of the malware.

The Aftermath: Implications of the Leak

The leak of ERMAC V3.0 source code has significant implications for the cybersecurity landscape. While it allows detection and prevention tools to be more effective, it also presents a risk of misuse by cybercriminals.

Potential Outcomes:

• Improved Detection and Prevention: Security researchers can analyze the source code to create more effective detection signatures. They can also develop new countermeasures to block ERMAC installations and activities within the network of a device.
• Increased Risk of Attacks: Cybercriminals can modify and reuse the code to create new strains of malware. It can be reused to update other malware.
• Exploitation of New Vulnerabilities: The source code can reveal new vulnerabilities that could be exploited by attackers.
• Attacks using updated and revised versions: Cybercriminals may revise the code to include new features or make it more resilient to detection,which could render existing security tools inadequate.

A Real-World Example:

A case study provided by “Threat Intelligence Report” highlighted how a copycat strain of ERMAC V3.0 emerged on various app stores within weeks of the source code leak. These modified variants targeted specific banking apps in diffrent regions, leading to increased instances of financial fraud.

Practical Tips for Staying safe

Protecting your devices and financial information is essential. the leak of ERMAC V3.0 highlights the need for vigilance and