MalwarePublished 15 Aug 2025Updated 14 Sep 2025

ERMAC V3.0 Banking Trojan: Full Source Code Leak and Infrastructure Analysis

Source AlienVault OTX General

Description

The complete source code for ERMAC V3.0, an advanced banking trojan, was discovered and analyzed, providing rare insight into this active Malware-as-a-Service platform. ERMAC has evolved to target over 700 financial and cryptocurrency apps, employing sophisticated form injection techniques and encrypted communications. The analysis revealed critical vulnerabilities, including hardcoded credentials and default tokens, which could be exploited to disrupt operations. The malware's infrastructure consists of a Laravel-based C2 backend, React control panel, Golang exfiltration service, and an obfuscated Android backdoor. This comprehensive examination exposes the operational risks of the MaaS model and equips defenders with concrete methods to track, detect, and disrupt active ERMAC campaigns.

Impact

For European organizations, especially financial institutions and cryptocurrency service providers, ERMAC V3.0 poses a significant threat to confidentiality and integrity of sensitive financial data. Successful infections could lead to theft of banking credentials, unauthorized transactions, and financial fraud. The encrypted communication channels and sophisticated form injection techniques make detection challenging, increasing the risk of prolonged undetected breaches. The leak of the source code also means that threat actors in Europe could develop tailored variants targeting region-specific financial apps, increasing attack efficacy. Additionally, the presence of hardcoded credentials in the malware infrastructure could be exploited by defenders or attackers to disrupt or hijack ongoing campaigns, potentially causing operational instability in affected networks. The Android backdoor component expands the attack surface to mobile banking users, a growing vector in Europe due to widespread smartphone usage. Overall, the threat could undermine trust in digital financial services and cause direct financial losses, regulatory penalties, and reputational damage for European organizations.

Defensive guidance

European organizations should implement targeted detection and prevention strategies beyond generic advice. Specifically: 1) Deploy advanced endpoint detection and response (EDR) solutions capable of detecting form injection and hooking techniques used by ERMAC. 2) Monitor network traffic for encrypted communications to known ERMAC C2 IP addresses and domains, leveraging threat intelligence feeds containing the identified IPs and hashes. 3) Conduct regular threat hunting exercises focused on indicators of compromise (IOCs) such as the provided file hashes and IP addresses. 4) Harden mobile device management (MDM) policies to restrict installation of unauthorized Android applications and monitor for suspicious behaviors indicative of the obfuscated Android backdoor. 5) Collaborate with financial app developers to identify and patch vulnerabilities that ERMAC exploits for form injection. 6) Leverage the leaked source code insights to develop custom detection signatures and disrupt malware infrastructure by exploiting the hardcoded credentials and default tokens. 7) Educate users on phishing and social engineering tactics to reduce initial infection vectors. 8) Establish incident response playbooks specific to banking trojan infections to minimize impact and recovery time.

Indicators of compromise

IP addresses 6

121.127.231.161
121.127.231.163
121.127.231.198
206.123.128.81
5.188.33.192
91.92.46.12

Hashes 2

175d4adc5fc0b0d8eb4b7d93b6f9694e4a3089e4ed4c59a2828d0667a9992aaa
8c81cebbaff9c9cdad69257f50af0f5208a0d5923659b4e0c3319333f9e8d545

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 15 Aug 2025, 13:03 UTC

MITRE ATT&CK techniques19 from threat tags

Technical details

Indicators of compromise

IP addresses 6

Hashes 2

Community reviews

Related threats