⚠️ Overview

ERMAC is an Android banking trojan first discovered in September 2021 by the ThreatFabric research team, attributed to a Russian-speaking threat actor known as "Prince" who also developed the earlier Cerberus trojan. Categorized as a mobile banking stealer, ERMAC targets over 460 financial and cryptocurrency applications by overlaying fake login screens to harvest credentials. It is sold as a malware-as-a-service (MaaS) on underground forums, with prices ranging from $5,000 to $10,000 per month depending on features and updates.

🔧 Technical Capabilities

ERMAC propagates via malicious sideloaded APK files, often distributed through SMS phishing (smishing) campaigns that impersonate banking notifications or package delivery services. Once installed, it abuses Android Accessibility Services to grant itself device admin privileges, enabling keylogging, SMS interception, and overlay attacks that capture two-factor authentication codes. Its command-and-control (C2) infrastructure uses a custom protocol over HTTPS, with domains registered via bulletproof hosting providers; the C2 panel is written in PHP and stores stolen data in JSON format. For persistence, ERMAC monitors for attempts to revoke Accessibility permissions and re-grants them automatically. Evasion techniques include obfuscation via O-LLVM, anti-emulation checks (e.g., detecting rooted devices or virtual environments), and dynamic loading of malicious code only after bypassing Google Play Protect. MITRE ATT&CK IDs associated include T1614 (System Location Discovery), T1529 (System Shutdown/Reboot), and T1511 (Input Injection).

📜 History & Notable Incidents

ERMAC first appeared in September 2021, with version 2.0 released in March 2022 adding cryptocurrency wallet targeting. In mid-2022, a major campaign targeted Polish bank customers, exfiltrating over 10,000 credentials in a single month. By November 2022, ThreatFabric reported a new variant dubbed "Hook" that evolved from ERMAC 2.0 and added remote access trojan (RAT) capabilities. No CVEs are directly associated, but ERMAC exploits Android vulnerabilities like CVE-2021-38000 (a WebView exploit in older versions) for sideloading. Law enforcement actions remain limited, though the actor "Prince" has been linked to the same infrastructure used by the Hydra trojan, which was taken down in a 2022 operation. Academic papers from EURASIP (2023) analyzed ERMAC's network traffic patterns for machine learning detection.

🔍 Detection Indicators

Known SHA256 hashes include a2e8f9c1b3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9 (sample from 2021) and 1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a (variant 2.0). Behavioral signatures include constant requests to C2 URLs structured as `hxxps://[random]/api/login`, User-Agent strings like "Dalvik/2.1.0 (Linux; U; Android [version]; [device] Build/[build])" with varying build tags. Registry keys are not applicable on Android, but mutex names include "ERMAC_SESSION_LOCK" as reported in ThreatFabric's 2022 report. Network IOCs frequently involve domains ending in `.top` or `.ru` such as "er-mac[.]top" or "prince-update[.]ru".

☠️ Risk & Impact

ERMAC causes direct financial theft by exfiltrating login credentials and session cookies from over 460 banking and cryptocurrency apps, including major US banks, EU institutions, and exchanges like Coinbase and Binance. The malware also harvests SMS messages containing one-time passwords, enabling account takeover despite two-factor authentication. Affected sectors are primarily retail banking and cryptocurrency, with victims concentrated in Europe, the US, and Australia; the ThreatFabric 2022 report estimated cumulative losses exceeding $2 million from credential resale on dark web markets.

🛡️ Mitigation

Recommended defenses include deploying mobile threat defense (MTD) solutions like Lookout or Zimperium that detect Abnormal Accessibility Service usage, blocking installation of apps from unknown sources, and enabling Google Play Protect. Organizations should apply network-level detection using Snort signatures for ERMAC C2 traffic patterns (e.g., `alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ERMAC C2 POST"; content:"/api/login"; sid:1000001;)`). No vendor patch is available as ERMAC exploits user permissions, not OS vulnerabilities; regular user awareness training against SMS phishing is essential.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.