Introduction

The joint police operation that brought down the Cabassous network infrastructure in May 2022, together with the slow but steady disappearance of Anatsa from the threat landscape, left an open space in the Android banking malware market. This space was filled initially by Hydra, and in minor part by the latest variants of ExobotCompact (also known as Octo). These two malware families stood out from the rest due to their advanced features, specifically the ability to perform Device Take-Over (DTO), by being able to remotely view and interact with the screen of the infected device.

In terms of volume, ThreatFabric observed only one other family which was comparable to these two: Ermac. Discovered in September 2021 by our researchers, this malware family is a spawn from the infamous Android Banker Cerberus.

Among the three, Hydra is by far the most spread, and has been the Android banker of choice for threat actors ever since the takedown of Cabassous in May 2022. However, the other two malware families have kept their numbers quite high, with ExobotCompact/Octo being slightly lower due to its distribution mechanism of choice, dropper applications on Google Play Store, which usually creates less builds, but produce more infections per malicious sample.

Ermac has been publicly rented by its actor DukeEugene for roughly one year and a half, with multiple actors being associated with the operations we had been observing. In March 2022, the actors behind this malware family tried to sell the botnet code on different hacking forums: from this point onwards, we started observing a rise in quantity of samples from Ermac, together with the appearance of different names and actors rebranding the bot and trying to rent it.

In this sphere of Ermac forks, ThreatFabric identified botnets such as MetaDroid and OWL, created from the Ermac source code and presenting minor differences. In the case of MetaDroid for example, the author removed the Locale check which was in place to ensure that the bot would not operate on devices from CIS countries.

In both cases, we did not observe any major difference in implementation or operations from the original Ermac samples to warrant the creation of a new malware variant.

Recently however, we encountered a new fork, which spiked our interest. This new malware variant, clearly based on Ermac, introduced the capability to manipulate files on the devices file system, as well as create a remote session able to interact with the System’s UI.

Based on the malware’s panel, we named this malware variant Hook. Initially, while performing our analysis and investigations, this malware looked like another fork of the original Ermac, once again spawned from the sale of the original source code.

However, on the 12th of January, the original actor of Ermac, DukeEugene, published a post advertising a brand new banking malware, called “Hook”.

From this thread, we can confidently say that Hook is the latest development of Ermac, and is developed and managed by its original author, DukeEugene.

A malware created “from scratch”

The malware is advertised as “written from scratch”. This is debatable, as the majority of the code base remains the one from Ermac, including some commands in Russian expressing an unnecessary angst towards the world, which in our opinion would have not made the cut if a proper revision of the code had taken place.

It is true that this malware variant introduces quite a lot of modifications compared to its predecessor, but it is fairly obvious that this is just an update and improvement of the previous versions of Ermac. It is likely that the criminals, taking an approach which is is very effective in marketing strategies, decided to start a new brand with their latest product, instead of maintaining th existing one, which was associated mostly with operations regarding cryptowallets and Personal Identifiable Information (PII) exfiltration.

In the following section we will cover the improvements added in Hook. If you want to find out the main features of Ermac, please refer to our previous blog about this family.

Capabilities

WebSocket communication

Hook uses the same encryption mechanisms used by Ermac in its communication with the C2 Server. The data is encrypted using AES-256-CBC with an hardcoded key, and then encoded in Base64. One modification that was done with this new malware variant, was the introduction of WebSocket communication in addition to the HTTP traffic used in the previous Ermac variants. The implementation relies on Socket.IO, which is an implementation over HTTP and WebSocket which enables real-time, bi-directional communication between web clients and servers.

After the malware is installed and successfully setup, the bot tries to contact its C2 server using normal HTTP traffic. The request triggers a response from the C2 in the following form

{
    "sid": "<alphanumeric_id>",
    "upgrades": ["websocket"],
    "pingInterval": 20000,
    "pingTimeout": 60000
}

This response triggers an upgrade to WebSocket traffic, which is how the bot communicates with its C2. If the value of “upgrades” is instead “polling”, the communication will be over HTTP. Over this channel, the bot registers with its server, sends the list of applications installed on the device and downloads the list of targets.

The communication protocol remains the same as it was in previous versions, with periodic requests for commands sent by the bot and updates on the latest logs collected from the malware. The server uses this channel to issue commands, still encrypted and encoded, in the form:

42["commands","<encrypted_commands>"]

Where 42 is a constant value based on Socket.IO protocol, with 4 being Engine.IO “message” packet type, and 2 being Socket.IO “message” packet type.

Addition of RAT capabilties

The most important addition in terms of capabilities comes in the form of what criminals call VNC. Virtual Network Computing (VNC) is a specific implementation of a screen sharing application that provides remote control over the device. However, threat actors have started using this term to indicate any sort of Remote Access Tool (RAT) feature. In the case of Hook, this is implemented using the Accessibility Services to interact with the different UI elements required to perform a wide array of operations.

With this feature, Hook joins the ranks of malware families that are able to perform full DTO, and complete a full fraud chain, from PII exfiltration to transaction, with all the intermediate steps, without the need of additional channels. This kind of operation is much harder to detect by fraud scoring engines, and is the main selling point for Android bankers.

The malware is capable of performing a wide array of operations on the device, from simulating clicks, to filling text boxes, and performing gestures. Here is reported the list of new commands related to the RAT features (in the Appendix you can find the full list, including the commands inherited from the previous versions of Ermac):

File manager

When the Server issues the “fmmanager” command, together with a specific parameter, the bot turns into a file manager for the actor, similarly in behavior to what we have previously observed in spyware.
Based on the parameter received, the malware either sends back to the server the full list of the files available on the device, or downloads a specific file from the file system:

To do so, the malware does not need to perform any specific shell command, but simply uses the available APIs from the Android Operating system, thanks to the permissions that the malware is able to grant itself on startup via Accessibility Services.

Another similar command is “getimages”, which allows the bot to view all the images on the device. With this command, the actor can identify if an image is of interest, and then use the “downloadimage” command to download it from the Bot Panel.

Other modifications and improvements

Finally, the authors added some additional commands to expand or improve the functionalities already existing in the previous versions of Ermac. It is worth noting that the second variant of Ermac, which surfaced in 2021, added the capability to extract seed phrases from wallets for cryptocurrencies using attacks similar to ATS (Automated Transfer System). These attacks interact with the UI, navigating the different application screens and logging the seed phrases, which are secret series of words used to retrieve the account’s credentials in case they are lost or forgotten.

In this new variant, the author added one more wallet to the list (in bold the latest additions):

Blurring the line

In our previous article we discussed SpyNote and its latest developments, bringing it closer to banking malware. On the opposite side of the spectrum lies Hook, which now is crossing the line that separates spyware and banking malware in the other direction.

One last interesting addition is the “openwhatsapp” command, used to open the social messaging application WhatsApp, and allows the malware to log and even send messages via this application. Utilizing the same Accessibility Services techniques used to interact with cryptocurrency wallets, Hook, upon receiving the “openwhatsapp” command, starts the social messaging application WhatsApp. From here the malware can proceed to extract via logging all the messages present, but also send a brand new message. This technique could be used by actors to spread the malware to other victims, via a channel that is regarded as less threatening by users.

In addition to this capability, this new Ermac variant also adds geolocation tracking, allowing criminals to receive the coordinates of the victim whenever needed.

if (Utils.checkPermission(this.ctx, "android.permission.ACCESS_FINE_LOCATION") != 0 && Utils.checkPermission(this.ctx, "android.permission.ACCESS_COARSE_LOCATION") != 0) {
    this.b();
    return;
}

Object object0 = this.ctx.getSystemService("location");
if (object0 != null) {
    LocationManager locationManager0 = (LocationManager) object0;
    String s = locationManager0.getBestProvider(new Criteria(), false);
    NonNullUtils.c(s);
    Location location0 = locationManager0.getLastKnownLocation("passive");
    this.sendLocation(location0);
    ...
}

These new features move this malware family in a sphere where the difference between spyware and banking malware is always more blurred and less evident.

Targets

As for previous versions of Ermac, the target list is very extensive, and includes institutions from all over the world.

The actor promises more than hundreds of targets to his buyers, which are made up for the large majority by the targets also present in previous versions of Ermac. However, this new version also adds dozens of new targets, including both financial applications as well as social apps. New targets also include bans from south America, Asia, Africa, and the Middle East.

Here you can see a recap of the areas mostly targeted by Hook:

Here we reported the top 10 countries ranked by number of targeted institutions. However, it is worth noting that the list is very extensive, and multiple other countries have just slightly lower numbers, as it can be seen in the full target list in the Appendix of this article.

Conclusions

The new developments around Hook, the latest variant of the Ermac family, point towards a clear direction. Hook now joins the very dangerous ranks of malware which is able to perform a full attack chain from infection to fraudulent transaction. In addition, it includes new capabilities typical of spyware, which allow criminals to track and spy on the device, gaining full visibility not only on the banking details of the victim, but also messaging, geolocation, and control over files present on the phone. As discussed, Ermac has been one of the most distributed malware families of 2022, and with the introduction of its latest development, Hook, ThreatFabric expects it to make the final quality leap, joining Hydra and ExobotCompact/Octo in the podium of Android Bankers available for rent.

Financial organizations are welcome to contact us: if you suspect some app be involved in malicious activity, feel free to reach our Mobile Threat Intelligence team which will provide additional details and help with reporting the malicious app if identified: mti@threatfabric.com.

Fraud Risk Suite

ThreatFabric’s Fraud Risk Suite enables safe & frictionless online customer journeys by integrating industry-leading mobile threat intel, behavioral analytics, advanced device fingerprinting and over 10.000 adaptive fraud indicators. This will give you and your customers peace of mind in an age of ever-changing fraud.

Appendix

Hook Samples

Hook Full command list

Hook C2s

Hook Crypto-Wallet targets

Hook Banking Targets