Leaked ERMAC source code reveals shared origin with HookBot Android banking trojan

The ERMAC source code leak confirms what security researchers have long suspected: ERMAC and HookBot are not independent malware families but branches of the same Android banking trojan. Both appear to have evolved from a common codebase, with minor modifications dictating their distinct operational identities. This shared origin suggests that defenses effective against one variant may also disrupt the other, reducing the effort required to mitigate both threats.

A single constant in the source code acts as a switch, determining whether the malware compiles as ERMAC or HookBot. This design choice implies a modular development approach, where operators can deploy either variant with minimal reconfiguration. For engineers, this modularity means that static and dynamic analysis tools can target the shared core rather than treating each variant as a separate problem, streamlining detection and reverse-engineering efforts.

The leak provides an unusual opportunity for defenders to examine the trojan’s internals without relying on obfuscated samples. Security teams can now map out the malware’s command-and-control infrastructure, persistence mechanisms, and data exfiltration techniques in detail. However, the absence of accompanying documentation or operational context limits the immediate utility of the leak, as researchers must still infer how the code behaves in active campaigns.

While the shared codebase simplifies some aspects of analysis, it does not guarantee that ERMAC and HookBot will remain identical. Future updates to either variant could introduce divergent features, complicating detection efforts. Engineers should treat this leak as a snapshot of the trojan’s state at a specific point in time, rather than a definitive reference for all future iterations. Continuous monitoring of both variants will be necessary to track their evolution.