ERMAC Source Leak Reveals HookBot's Shared Core

Executive Summary

The ERMAC source code leak has revealed that the Android banking trojans ERMAC and HookBot are not separate families but two branches of a single codebase, according to research from Censys. A single constant in the source determines which name the command-and-control panel displays, meaning defenders can now treat them as one threat lineage rather than two unrelated operations. The finding gives security teams a concrete way to fingerprint both families using indicators derived from the shared core.

Censys researchers, who analyzed the leaked source, found that ERMAC and HookBot forked from a common code base and evolved independently, but the core functionality remains so similar that a single constant switches the panel branding between the two names. This is not a rebranding but a genuine fork—each branch has developed its own features and infrastructure, yet the shared foundation means detections built for one can often apply to the other. For defenders, the practical takeaway is that tracking ERMAC and HookBot as separate entities is a mistake; they are two faces of the same malware family.

Technical Analysis

Censys's analysis focuses on the source code of ERMAC, which was leaked, and compares it to HookBot, a newer variant. The key finding is that the two share a common codebase, with a specific constant in the source that toggles the panel name between "ERMAC" and "HookBot." This constant is not a cosmetic label but a functional switch that affects how the malware presents itself to the operator.

The shared core includes the same overlay attack mechanisms, accessibility service abuse, and command-and-control (C2) communication protocols. Both families use similar techniques to steal credentials and intercept SMS messages for two-factor authentication bypass. The fork appears to have occurred early in ERMAC's development, with HookBot adding new features such as improved evasion and a more modular plugin system, while ERMAC retained a more traditional, monolithic structure.

Censys researchers note that the leak provides a unique opportunity to map the exact code differences between the two branches. By comparing the source, they identified specific functions and routines that are identical, which can be used to create YARA rules or detection signatures that catch both families. The researchers also highlight that the leak includes configuration files and build scripts, which reveal the infrastructure used by the operators, though Censys did not publish specific IPs or domains in their blog post.

One notable technical detail is that the panel branding is not hardcoded in the binary but is determined at runtime based on the constant. This means that the same binary could be repurposed to display either name, depending on how it is compiled. This has implications for attribution: a sample that appears to be HookBot might actually be an ERMAC variant with the constant flipped, and vice versa.

Mitigations & Recommendations

Given the shared codebase, defenders should consolidate their detection strategies for ERMAC and HookBot. Instead of maintaining separate signatures, security teams should look for indicators that are common to both families, such as specific accessibility service names, overlay package names, and C2 URL patterns that Censys has identified. The researchers recommend that organizations with Android devices in their environment, particularly in financial services, review their mobile threat defense logs for any of these common indicators.

Because the source leak is public, threat actors may also use it to create new variants or improve existing ones. Defenders should monitor for new samples that share code similarities with the leaked source, even if they are branded differently. Censys advises that YARA rules based on the shared code sections can be effective in catching both known and unknown variants.

For enterprises, the primary risk is credential theft and SMS interception on employee devices used for banking or corporate accounts. Implementing app-level security that restricts accessibility service permissions and SMS forwarding can reduce the impact of such trojans. Additionally, using hardware-backed keystores and phishing-resistant MFA can mitigate the risk even if credentials are stolen.