{
	"id": "31e2c075-262f-430d-85d0-e8e38af1c3e1",
	"created_at": "2026-04-29T08:21:51.710221Z",
	"updated_at": "2026-04-29T10:42:12.740337Z",
	"deleted_at": null,
	"sha1_hash": "d5e140f3af7eb0fce85f56fc6476d520e7f2213c",
	"title": "ERMAC - another Cerberus reborn",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 93106,
	"plain_text": "ERMAC - another Cerberus reborn\r\nPublished: 2024-10-01 · Archived: 2026-04-29 07:43:56 UTC\r\nOn July 23 a forum post appeared regarding a new Android banking trojan. The attached screenshots show that it is named\r\nERMAC. Our investigation shows that ERMAC is almost fully based on the well-known banking trojan Cerberus, and is\r\nbeing operated by BlackRock actor(s).\r\nOn August 17, a forum member named “ermac” invited anyone interested in this topic to send a PM to make a deal. The user\r\nregistered just the day before and posted a similar advertisement in his profile. Interestingly enough, the topic starter said\r\nthat he found the contact 4 days earlier. On the same day, another forum member, “DukeEugene”, posted a message in his\r\naccount:\r\n“Android botnet ERMAC. I will rent a new android botnet with wide functionality to a narrow circle of people (10 people).\r\n3k$ per month. Details in PM.”\r\nDukeEugene is known as an actor behind the BlackRock banking trojan that we discovered in 2020. DukeEugene claimed to\r\nbe the one of the actors shortly after we published our discovery.\r\nConclusion\r\nThe story of ERMAC shows one more time how malware source code leaks can lead not only to slow evaporation of the\r\nmalware family but also bring new threats/actors to the threat landscape. Being built on Cerberus basement, ERMAC\r\nintroduces couple of new features. Although it lacks some powerful features like RAT, it remains a threat for mobile banking\r\nusers and financial institutions all over the world.\r\nHow we help our customers\r\nThreatFabric makes it easier than it has ever been to run a secure mobile payments business. With the most advanced threat\r\nintelligence for mobile banking, financial institutions can build a risk-based mobile security strategy and use this unique\r\nknowledge to detect fraud-by-malware on the mobile devices of customers in real-time.\r\nTogether with our customers and partners, we are building an easy-to-access information system to tackle the ever growing\r\nthreat of mobile malware targeting the financial sector. We especially like to thank the Cyber Defence Alliance (CDA) for\r\ncollaborating and proactively sharing knowledge and information across the financial sector to fight cyber-threats.\r\nThreatFabric has partnerships with TIPs all over the world.\r\nIf you want to request a free trial of our MTI-feed, or want to test our own MTI portal for 30 days, feel free to contact us\r\nat: sales@threatfabric.com\r\nIf you want more information on how we detect mobile malware on mobile devices, you can directly contact us\r\nat: info@threatfabric.com\r\nAppendix\r\nERMAC Samples\r\nhttps://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html\r\nPage 1 of 16\n\nApp name Package name SHA-256\r\nmObywatel com.tafupqzpqgmn.tmnhkq 495a0621b2afc6adefbf17dc6c3cf5e92ba8227ac6939a20439b1b9dde878617\r\nGoogle\r\nChrome\r\ncom.hxfumpfgokky.bufvpk 2de0f59fd03512e5527c8b8b19595483564ae54cd4904457c4f5bf127949019d\r\nDPD\r\nMobile\r\ncom.mhyjbezusdvpxu.jukviuhn 1032b42c859c747bcc159b75366c3325869d3722f5673d13a7b06633245ebf32\r\nBoxDeals com.czxvfknrqnqv.huslcn 65619e3afe53268f5cbe5eae6a429f23e712c4412eda8c70dcfd3ebb25382894\r\nC2 URL\r\nURL\r\nhxxp://185.215.113.42:3000/gate.php\r\nhxxp://185.215.113.94:3000/gate.php\r\nhxxp://185.215.113.81:3000/gate.php\r\nhxxp://178.132.6.150:3000/gate.php\r\nTargets\r\nThe list of the targeted applications.\r\nPackageName AppName\r\nalior.bankingapp.android Usługi Bankowe\r\napp.wizink.es WiZink, tu banco senZillo\r\nar.com.santander.rio.mbanking Santander Argentina\r\nat.spardat.bcrmobile Touch 24 Banking BCR\r\nat.volksbank.volksbankmobile Volksbank hausbanking\r\nau.com.amp.myportfolio.android My AMP\r\nau.com.bankwest.mobile Bankwest\r\nau.com.commbank.commbiz.prod CommBiz\r\nau.com.cua.mb CUA Mobile Banking\r\nau.com.hsbc.hsbcaustralia HSBC Australia\r\nau.com.ingdirect.android ING Australia Banking\r\nau.com.macquarie.authenticator Macquarie Authenticator\r\nau.com.macquarie.banking Macquarie Mobile Banking\r\nhttps://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html\r\nPage 2 of 16\n\nPackageName AppName\r\nau.com.mebank.banking ME Bank\r\nau.com.nab.mobile NAB Mobile Banking\r\nau.com.newcastlepermanent NPBS Mobile Banking\r\nau.com.rams.RAMS myRAMS\r\nau.com.suncorp.SuncorpBank Suncorp Bank\r\nau.com.ubank.internetbanking UBank Mobile Banking\r\nca.mobile.explorer CA Mobile\r\nca.tangerine.clients.banking.app Tangerine Mobile Banking\r\ncc.bitbank.bitbank bitbank - Bitcoin \u0026 Ripple Wallet\r\ncgd.pt.caixadirectaparticulares Caixadirecta\r\nch.autoscout24.autoscout24 AutoScout24 Switzerland – Find your new car\r\ncl.bancochile.mbanking Mi Banco de Chile\r\nclientapp.swiftcom.org ePayments: wallet \u0026 bank card\r\nco.edgesecure.app\r\nEdge - Bitcoin, Ethereum, Monero, Ripple\r\nWallet\r\nco.zip Zip - Shop Now, Pay Later\r\ncom.BOQSecure BOQ Secure\r\ncom.CIMB.OctoPH CIMB Bank PH\r\ncom.CredemMobile Credem\r\ncom.EurobankEFG Eurobank Mobile App\r\ncom.IngDirectAndroid ING France\r\ncom.Plus500\r\nPlus500: CFD Online Trading on Forex and\r\nStocks\r\ncom.Version1 PNB ONE\r\ncom.aadhk.woinvoice Invoice Maker: Estimate \u0026 Invoice App\r\ncom.abanca.bancaempresas ABANCA Empresas\r\ncom.abanca.bm.pt ABANCA - Portugal\r\ncom.abnamro.nl.mobile.payments ABN AMRO Mobiel Bankieren\r\ncom.advantage.RaiffeisenBank Raiffeisen Smart Mobile\r\nhttps://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html\r\nPage 3 of 16\n\nPackageName AppName\r\ncom.aff.otpdirekt OTP SmartBank\r\ncom.airbitz Bitcoin Wallet - Airbitz\r\ncom.akbank.android.apps.akbank_direkt Akbank\r\ncom.albarakaapp Albaraka Mobile Banking\r\ncom.alrajhiretailapp Al Rajhi Mobile\r\ncom.amazon.mShop.android.shopping\r\nAmazon Shopping - Search, Find, Ship, and\r\nSave\r\ncom.amazon.sellermobile.android Amazon Seller\r\ncom.ambank.ambankonline AmOnline\r\ncom.americanexpress.android.acctsvcs.us Amex\r\ncom.android.vending Google Play\r\ncom.anz.android.gomoney ANZ Australia\r\ncom.anz.transactive.global ANZ Transactive - Global\r\ncom.aol.mobile.aolapp AOL - News, Mail \u0026 Video\r\ncom.appfactory.tmb Teachers Mutual Bank\r\ncom.arkea.android.application.cmb Crédit Mutuel de Bretagne\r\ncom.arkea.android.application.cmso2 CMSO ma banque : solde, virement \u0026 épargne\r\ncom.att.myWireless myAT\u0026T\r\ncom.azimo.sendmoney Azimo Money Transfer\r\ncom.bancodebogota.bancamovil Banco de Bogotá\r\ncom.bancomer.mbanking BBVA México (Bancomer Móvil)\r\ncom.bankaustria.android.olb Bank Austria MobileBanking\r\ncom.bankinter.empresas Bankinter Empresas\r\ncom.bankinter.launcher Bankinter Móvil\r\ncom.bankofqueensland.boq BOQ Mobile\r\ncom.barclaycardus Barclays US\r\ncom.barclays.android.barclaysmobilebanking Barclays\r\ncom.barclays.ke.mobile.android.ui Barclays Kenya\r\ncom.bbva.bbvacontigo BBVA Spain\r\nhttps://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html\r\nPage 4 of 16\n\nPackageName AppName\r\ncom.bbva.mobile.pt BBVA Portugal\r\ncom.bbva.netcash BBVA Net Cash | ES \u0026 PT\r\ncom.bbva.nxt_peru BBVA Perú\r\ncom.bcp.bank.bcp Banca Móvil BCP\r\ncom.bendigobank.mobile Bendigo Bank\r\ncom.binance.dev Binance - Buy \u0026 Sell Bitcoin Securely\r\ncom.bitfinex.mobileapp Bitfinex\r\ncom.bitmarket.trader Aplikacja Bitmarket\r\ncom.bitpay.wallet BitPay – Secure Bitcoin Wallet\r\ncom.bmo.mobile BMO Mobile Banking\r\ncom.bmoharris.digital BMO Digital Banking\r\ncom.bochk.com BOCHK\r\ncom.botw.mobilebanking Bank of the West Mobile\r\ncom.boursorama.android.clients Boursorama Banque\r\ncom.btcturk BtcTurk Bitcoin Borsası\r\ncom.caisse.epargne.android.tablette Banque pour tablettes Android\r\ncom.caisseepargne.android.mobilebanking Banque\r\ncom.cajasiete.android.cajasietereport Report\r\ncom.cajasur.android Cajasur\r\ncom.chase.sig.android Chase Mobile\r\ncom.cibc.android.mobi CIBC Mobile Banking®\r\ncom.cic_prod.bad CIC\r\ncom.cimbmalaysia CIMB Clicks Malaysia\r\ncom.citibank.CitibankMY Citibank MY\r\ncom.citizensbank.androidapp Citizens Bank Mobile Banking\r\ncom.clairmail.fth Fifth Third Mobile Banking\r\ncom.cm_prod.bad Crédit Mutuel\r\ncom.coinbase.android Coinbase – Buy \u0026 Sell Bitcoin. Crypto Wallet\r\ncom.comarch.mobile.banking.bgzbnpparibas.biznes Mobile BiznesPl@net\r\nhttps://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html\r\nPage 5 of 16\n\nPackageName AppName\r\ncom.comarch.security.mobilebanking ING Business\r\ncom.commbank.netbank CommBank\r\ncom.connectivityapps.hotmail\r\nConnect for Hotmail \u0026 Outlook: Mail and\r\nCalendar\r\ncom.cooperativebank.bank The Co-operative Bank\r\ncom.csam.icici.bank.imobile iMobile by ICICI Bank\r\ncom.db.mm.norisbank norisbank App\r\ncom.db.pbc.DBPay DB Pay\r\ncom.db.pbc.miabanca La Mia Banca\r\ncom.db.pbc.mibanco Mi Banco db\r\ncom.db.pwcc.dbmobile Deutsche Bank Mobile\r\ncom.denizbank.mobildeniz MobilDeniz\r\ncom.desjardins.mobile Desjardins mobile services\r\ncom.dhanlaxmi.dhansmart.mtc Dhanlaxmi Bank Mobile Banking\r\ncom.discoverfinancial.mobile Discover Mobile\r\ncom.ebay.mobile\r\neBay: Buy, sell, and save money on home\r\nessentials\r\ncom.empik.empikapp Empik\r\ncom.empik.empikfoto Empik Foto\r\ncom.engage.pbb.pbengage2my.release PB engage MY\r\ncom.eofinance\r\nEO.Finance: Buy and Sell Bitcoin. Crypto\r\nWallet\r\ncom.exictos.mbanka.bic Banco BIC, SA\r\ncom.exmo\r\nEXMO Official - Trading crypto on the\r\nexchange\r\ncom.facebook.katana Facebook\r\ncom.fi7026.godough Commercial Bank Mobile Banking\r\ncom.fibabanka.Fibabanka.mobile Fibabanka Mobile\r\ncom.fibabanka.mobile Fibabanka Corporate Mobile\r\ncom.finansbank.mobile.cepsube QNB Finansbank Mobile Banking\r\nhttps://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html\r\nPage 6 of 16\n\nPackageName AppName\r\ncom.finanteq.finance.bgz BNP Paribas GOMobile\r\ncom.finanteq.finance.ca CA24 Mobile\r\ncom.fortuneo.android\r\nFortuneo, mes comptes banque \u0026 bourse en\r\nligne\r\ncom.fullsix.android.labanquepostale.accountaccess La Banque Postale\r\ncom.fusion.ATMLocator People’s Choice Credit Union\r\ncom.fusion.banking Bank Australia app\r\ncom.fusion.beyondbank Beyond Bank Australia\r\ncom.garanti.cepsubesi Garanti BBVA Mobile\r\ncom.getingroup.mobilebanking Getin Mobile\r\ncom.gmowallet.mobilewallet\r\nビットコイン・暗号資産（仮想通貨）ウォ\r\nレットアプリ GMOコイン\\｜チャート・購\r\n入・レバレッジ取引\r\ncom.google.android.gm Gmail\r\ncom.greater.Greater Greater Bank\r\ncom.grppl.android.shell.BOS\r\nBank of Scotland Mobile Banking: secure on\r\nthe go\r\ncom.grppl.android.shell.CMBlloydsTSB73 Lloyds Bank Mobile Banking: by your side\r\ncom.grppl.android.shell.halifax Halifax: the banking app that gives you extra\r\ncom.grupoavaloc1.bancamovil Banco de Occidente Móvil\r\ncom.grupocajamar.wefferent Grupo Cajamar\r\ncom.hsbc.hsbcnet HSBCnet Mobile\r\ncom.htsu.hsbcpersonalbanking HSBC Mobile Banking\r\nבנק הפועלים - ניהול החשבון hapoalim.ideomobile.com\r\ncom.imaginbank.app imaginBank - Your mobile bank\r\ncom.imo.android.imoim imo free video calls and chat\r\ncom.imo.android.imoimbeta imo beta free calls and text\r\ncom.imo.android.imoimhd imo HD-Free Video Calls and Chats\r\ncom.indra.itecban.mobile.novobanco NBapp Spain\r\ncom.indra.itecban.triodosbank.mobile.banking Triodos Bank. Banca Móvil\r\nhttps://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html\r\nPage 7 of 16\n\nPackageName AppName\r\ncom.infonow.bofa Bank of America Mobile Banking\r\ncom.infrasofttech.CentralBank Cent Mobile\r\ncom.infrasofttech.MahaBank Maha Mobile\r\ncom.ingbanktr.ingmobil ING Mobil\r\ncom.instagram.android Instagram\r\ncom.isis_papyrus.raiffeisen_pay_eyewdg Raiffeisen ELBA\r\ncom.itau.empresas\r\nItaú Empresas: Controle e Gestão do seu\r\nNegócio\r\ncom.kasikorn.retail.mbanking.wap K PLUS\r\ncom.key.android KeyBank Mobile\r\ncom.konylabs.HongLeongConnect Hong Leong Connect Mobile Banking\r\ncom.konylabs.capitalone Capital One® Mobile\r\ncom.konylabs.cbplpat Citi Handlowy\r\ncom.kraken.trade Pro: Advanced Bitcoin \u0026 Crypto Trading\r\ncom.krungsri.kma KMA\r\ncom.kutxabank.android Kutxabank\r\ncom.kuveytturk.mobil Kuveyt Türk\r\ncom.latuabancaperandroid Intesa Sanpaolo Mobile\r\ncom.leumi.leumiwallet לאומי\r\ncom.lynxspa.bancopopolare YouApp\r\ncom.magiclick.odeabank Odeabank\r\ncom.mail.mobile.android.mail mail.com mail\r\ncom.mcom.firstcitizens First Citizens Mobile Banking\r\ncom.mercadolibre Mercado Libre: compra fácil y rápido\r\ncom.mercadopago.wallet Mercado Pago\r\ncom.mfoundry.mb.android.mb_136 People’s United Bank Mobile\r\ncom.microsoft.office.outlook\r\nMicrosoft Outlook: Organize Your Email \u0026\r\nCalendar\r\ncom.mobikwik_new\r\nBHIM UPI, Money Transfer, Recharge \u0026 Bill\r\nPayment\r\nhttps://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html\r\nPage 8 of 16\n\nPackageName AppName\r\ncom.mobileloft.alpha.droid myAlpha Mobile\r\ncom.mobillium.papara Papara\r\ncom.moneybookers.skrillpayments Skrill - Fast, secure online payments\r\ncom.moneybookers.skrillpayments.neteller\r\nNETELLER - fast, secure and global money\r\ntransfers\r\ncom.msf.kbank.mobile Kotak - 811 \u0026 Mobile Banking\r\ncom.mtel.androidbea BEA 東亞銀行\r\ncom.mycelium.wallet Mycelium Bitcoin Wallet\r\ncom.navyfederal.android Navy Federal Credit Union\r\ncom.nearform.ptsb permanent tsb\r\ncom.netflix.mediaclient Netflix\r\ncom.ocito.cdn.activity.creditdunord Crédit du Nord pour Mobile\r\ncom.oxigen.oxigenwallet Bill Payment \u0026 Recharge,Wallet\r\ncom.paribu.app Paribu\r\ncom.paxful.wallet Paxful Bitcoin Wallet\r\ncom.payeer PAYEER\r\ncom.payoneer.android\r\nPayoneer – Global Payments Platform for\r\nBusinesses\r\ncom.paypal.android.p2pmobile\r\nPayPal Mobile Cash: Send and Request Money\r\nFast\r\ncom.pcfinancial.mobile Simplii Financial\r\ncom.pnc.ecommerce.mobile PNC Mobile\r\ncom.polehin.android Bitcoin Wallet - Buy BTC\r\ncom.pozitron.iscep İşCep - Mobile Banking\r\ncom.pttfinans PTTBank\r\ncom.quoine.quoinex.light\r\nLiquid by Quoineライト版（リキッドバイコ\r\nイン） -ビットコインなどの仮想通貨取引\r\n所\r\ncom.rbc.mobile.android RBC Mobile\r\ncom.rbs.mobile.android.natwest NatWest Mobile Banking\r\ncom.rbs.mobile.android.rbs Royal Bank of Scotland Mobile Banking\r\nhttps://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html\r\nPage 9 of 16\n\nPackageName AppName\r\ncom.rsi ruralvía\r\ncom.samba.mb SambaMobile\r\ncom.santander.bpi Santander Private Banking\r\ncom.sbi.SBAnywhereCorporate SBI Anywhere Corporate\r\ncom.sbi.SBIFreedomPlus Yono Lite SBI - Mobile Banking\r\ncom.scb.phone SCB EASY\r\ncom.scotiabank.banking Scotiabank Mobile Banking\r\ncom.snapchat.android Snapchat\r\ncom.snapwork.IDBI IDBI Bank GO Mobile+\r\ncom.snapwork.hdfc HDFC Bank MobileBanking\r\ncom.squareup.cash Cash App\r\ncom.starfinanz.smob.android.sfinanzstatus Sparkasse Ihre mobile Filiale\r\ncom.suntrust.mobilebanking SunTrust Mobile App\r\ncom.targo_prod.bad TARGOBANK Mobile Banking\r\ncom.tarjetanaranja.emisor.serviciosClientes.appTitulares Naranja\r\ncom.td TD Canada\r\ncom.tdbank TD Bank (US)\r\ncom.teb CEPTETEB\r\ncom.tecnocom.cajalaboral Banca Móvil Laboral Kutxa\r\ncom.tencent.mm WeChat\r\ncom.tideplatform.banking Tide - Smart Mobile Banking\r\ncom.tmobtech.halkbank Halkbank Mobil\r\ncom.todo1.davivienda.mobileapp Davivienda Móvil\r\ncom.todo1.mobile Bancolombia App Personas\r\ncom.transferwise.android TransferWise Money Transfer\r\ncom.twitter.android Twitter\r\ncom.twitter.android.lite Twitter Lite\r\ncom.ubercab Uber - Request a ride\r\ncom.ubercab.eats Uber Eats: Food Delivery\r\nhttps://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html\r\nPage 10 of 16\n\nPackageName AppName\r\ncom.unicredit Mobile Banking UniCredit\r\ncom.unionbank.ecommerce.mobile.android Union Bank Mobile Banking\r\ncom.unocoin.unocoinwallet Unocoin Wallet\r\ncom.usaa.mobile.android.usaa USAA Mobile\r\ncom.usbank.mobilebanking U.S. Bank - Inspired by customers\r\ncom.uy.itau.appitauuypf Itaú Uruguay\r\ncom.vakifbank.mobile VakıfBank Mobil Bankacılık\r\ncom.vancity.mobileapp Vancity\r\ncom.viber.voip\r\nViber Messenger - Messages, Group Chats \u0026\r\nCalls\r\ncom.westernunion.moneytransferr3app.es\r\nWestern Union ES - Send Money Transfers\r\nQuickly\r\ncom.wf.wellsfargomobile Wells Fargo Mobile\r\ncom.whatsapp WhatsApp Messenger\r\ncom.whatsapp.w4b WhatsApp Business\r\ncom.woodforest Woodforest Mobile Banking\r\ncom.wrx.wazirx\r\nWazirX - Buy Sell Bitcoin \u0026 Other\r\nCryptocurrencies\r\ncom.yahoo.mobile.client.android.mail Yahoo Mail – Organized Email\r\ncom.ykb.android Yapı Kredi Mobile\r\ncom.zellepay.zelle Zelle\r\ncom.ziraat.ziraatmobil Ziraat Mobile\r\ncom.zoluxiones.officebanking Banco Santander Perú S.A.\r\ncz.csob.smartbanking ČSOB Smartbanking\r\nde.adesso_mobile.secureapp.netbank SecureApp netbank\r\nde.comdirect.android comdirect mobile App\r\nde.commerzbanking.mobil Commerzbank Banking - The app at your side\r\nde.consorsbank Consorsbank\r\nde.dkb.portalapp DKB-Banking\r\nde.fiducia.smartphone.android.banking.vr VR Banking Classic\r\nhttps://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html\r\nPage 11 of 16\n\nPackageName AppName\r\nde.ingdiba.bankingapp ING Banking to go\r\nde.mobile.android.app mobile.de – Germany‘s largest car market\r\nde.number26.android N26 — The Mobile Bank\r\nde.postbank.finanzassistent Postbank Finanzassistent\r\nde.santander.presentation Santander Banking\r\nde.traktorpool tractorpool\r\nenterprise.com.anz.shield ANZ Shield\r\nes.bancosantander.apps Santander\r\nes.bancosantander.empresas Santander Empresas\r\nes.caixagalicia.activamovil ABANCA- Banca Móvil\r\nes.caixageral.caixageralapp Banco Caixa Geral España\r\nes.ceca.cajalnet Cajalnet\r\nes.cm.android Bankia\r\nes.evobanco.bancamovil EVO Banco móvil\r\nes.ibercaja.ibercajaapp Ibercaja\r\nes.lacaixa.mobile.android.newwapicon CaixaBank\r\nes.liberbank.cajasturapp Banca Digital Liberbank\r\nes.openbank.mobile Openbank – banca móvil\r\nes.pibank.customers Pibank\r\nes.univia.unicajamovil UnicajaMovil\r\neu.atlantico.bancoatlanticoapp MY ATLANTICO\r\neu.eleader.mobilebanking.invest plusbank24\r\neu.eleader.mobilebanking.pekao Pekao24Makler\r\neu.eleader.mobilebanking.pekao.firm PekaoBiznes24\r\neu.inmite.prj.kb.mobilbank Mobilni Banka\r\neu.netinfo.colpatria.system Scotiabank Colpatria\r\neu.unicreditgroup.hvbapptan HVB Mobile Banking\r\nfinansbank.enpara Enpara.com Cep Şubesi\r\nfr.banquepopulaire.cyberplus Banque Populaire\r\nhttps://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html\r\nPage 12 of 16\n\nPackageName AppName\r\nfr.creditagricole.androidapp Ma Banque\r\nfr.laposte.lapostemobile La Poste - Services Postaux\r\nfr.lcl.android.customerarea Mes Comptes - LCL\r\nfr.oney.mobile.mescomptes Oney France\r\ngr.winbank.mobilenext Winbank Mobile\r\ngt.com.bi.bienlinea Bi en Línea\r\nhr.asseco.android.mtoken.bos iBOSStoken\r\nhu.bb.mobilapp Budapest Bank Mobil App\r\nhu.cardinal.cib.mobilapp CIB Business Online\r\nhu.cardinal.erste.mobilapp Erste Business MobilBank\r\nhu.mkb.mobilapp MKB Mobilalkalmazás\r\nid.co.bitcoin Indodax\r\nio.cex.app.prod CEX.IO Cryptocurrency Exchange\r\nio.ethos.universalwallet Ethos Universal Wallet\r\nit.bnl.apps.banking BNL\r\nit.carige Carige Mobile\r\nit.copergmps.rt.pf.android.sp.bmps Banca MPS\r\nit.ingdirect.app ING Italia\r\nit.nogood.container UBI Banca\r\nit.popso.SCRIGNOapp SCRIGNOapp\r\njp.co.netbk 住信SBIネット銀行\r\njp.co.rakuten_bank.rakutenbank 楽天銀行 -個人のお客様向けアプリ\r\njp.coincheck.android Bitcoin Wallet Coincheck\r\nktbcs.netbank Krungthai NEXT\r\nma.gbp.pocketbank Pocket Bank\r\nmbanking.NBG NBG Mobile Banking\r\nme.cryptopay.android C.PAY\r\nmobi.societegenerale.mobile.lappli L’Appli Société Générale\r\nmx.bancosantander.supermovil Santander móvil\r\nhttps://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html\r\nPage 13 of 16\n\nPackageName AppName\r\nmy.com.hsbc.hsbcmalaysia HSBC Malaysia\r\nmy.com.maybank2u.m2umobile Maybank2u MY\r\nnet.bnpparibas.mescomptes Mes Comptes BNP Paribas\r\nnet.garagecoders.e_llavescotiainfo ScotiaMóvil\r\nnet.inverline.bancosabadell.officelocator.android Banco Sabadell App. Your mobile bank\r\nnz.co.asb.asbmobile ASB Mobile Banking\r\norg.banking.bom.businessconnect Bank of Melbourne Business App\r\norg.banking.bsa.businessconnect BankSA Business App\r\norg.banking.stg.businessconnect St.George Business App\r\norg.banksa.bank BankSA Mobile Banking\r\norg.bom.bank Bank of Melbourne Mobile Banking\r\norg.microemu.android.model.common.VTUserApplicationLINKMB Link Celular\r\norg.stgeorge.bank St.George Mobile Banking\r\norg.telegram.messenger Telegram\r\norg.toshi\r\nCoinbase Wallet — Crypto Wallet \u0026 DApp\r\nBrowser\r\norg.westpac.bank Westpac Mobile Banking\r\norg.westpac.col Westpac Corporate Mobile\r\npe.com.interbank.mobilebanking Interbank APP\r\npegasus.project.ebh.mobile.android.bundle.mobilebank George Magyarország\r\npiuk.blockchain.android\r\nBlockchain Wallet. Bitcoin, Bitcoin Cash,\r\nEthereum\r\npl.aliorbank.aib Alior Mobile\r\npl.allegro\r\nAllegro - convenient and secure online\r\nshopping\r\npl.bph BusinessPro Lite\r\npl.bps.bankowoscmobilna BPS Mobilnie\r\npl.bzwbk.bzwbk24 Santander mobile\r\npl.bzwbk.ibiznes24 iBiznes24 mobile\r\npl.ceneo Ceneo - zakupy i promocje\r\nhttps://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html\r\nPage 14 of 16\n\nPackageName AppName\r\npl.com.rossmann.centauros Rossmann PL\r\npl.envelobank.aplikacja EnveloBank\r\npl.eurobank2 eurobank mobile 2.0\r\npl.fakturownia Fakturownia.pl\r\npl.ideabank.mobilebanking Idea Bank PL\r\npl.ifirma.ifirmafaktury IFIRMA - Darmowy Program do Faktur\r\npl.ing.mojeing Moje ING mobile\r\npl.mbank mBank PL\r\npl.millennium.corpApp Bank Millennium for Companies\r\npl.nestbank.nestbank Nest Bank nowy\r\npl.noblebank.mobile Noble Mobile\r\npl.orange.mojeorange Mój Orange\r\npl.pkobp.iko IKO\r\npl.pkobp.ipkobiznes iPKO biznes\r\npl.raiffeisen.nfc Mobilny Portfel\r\nposteitaliane.posteapp.apppostepay Postepay\r\npt.bancobpi.mobile.fiabilizacao BPI APP\r\npt.novobanco.nbapp NB smart app\r\npt.santandertotta.mobileparticulares Santander Particulares\r\nro.btrl.mobile Banca Transilvania\r\nsoftax.pekao.powerpay PeoPay\r\ntr.com.hsbc.hsbcturkey HSBC Turkey\r\ntr.com.sekerbilisim.mbank ŞEKER MOBİL ŞUBE\r\ntsb.mobilebanking TSB Bank Mobile Banking\r\nuk.co.hsbc.hsbcukmobilebanking HSBC UK Mobile Banking\r\nuk.co.mbna.cardservices.android MBNA - Card Services App\r\nuk.co.metrobankonline.mobile.android.production Metro Bank\r\nuk.co.santander.santanderUK Santander Mobile Banking\r\nuk.co.tescomobile.android Tesco Mobile\r\nhttps://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html\r\nPage 15 of 16\n\nPackageName AppName\r\nuk.co.tsb.newmobilebank TSB Mobile Banking\r\nuy.brou App Móvil del Banco República\r\nuy.com.brou.token BROU Llave Digital\r\nwit.android.bcpBankingApp.millennium Millenniumbcp\r\nwit.android.bcpBankingApp.millenniumPL Bank Millennium\r\nwww.ingdirect.nativeframe ING España. Banca Móvil\r\nSource: https://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html\r\nhttps://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html\r\nPage 16 of 16",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html"
	],
	"report_names": [
		"ermac-another-cerberus-reborn.html"
	],
	"threat_actors": [
		{
			"id": "8309f9cf-9abb-4ce3-aa1e-cda7d7f5c1b3",
			"created_at": "2022-10-25T16:07:23.729215Z",
			"updated_at": "2026-04-29T10:39:55.333912Z",
			"deleted_at": null,
			"main_name": "Indra",
			"aliases": [],
			"source_name": "ETDA:Indra",
			"tools": [
				"Stardust"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "8d28f58b-5ea2-4450-a74a-4a1e39caba6e",
			"created_at": "2026-03-16T02:02:50.582318Z",
			"updated_at": "2026-04-29T10:39:54.795075Z",
			"deleted_at": null,
			"main_name": "COASTLIGHT",
			"aliases": [
				"Gonjeshke Darande",
				"Indra",
				"Predatory Sparrow"
			],
			"source_name": "Secureworks:COASTLIGHT",
			"tools": [],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "219ddb41-2ea8-4121-8b63-8c762f7e15df",
			"created_at": "2023-01-06T13:46:39.384442Z",
			"updated_at": "2026-04-29T10:39:53.350514Z",
			"deleted_at": null,
			"main_name": "Predatory Sparrow",
			"aliases": [
				"Indra",
				"Gonjeshke Darande"
			],
			"source_name": "MISPGALAXY:Predatory Sparrow",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "47a8f6c7-5b29-4892-8f47-1d46be71714f",
			"created_at": "2025-08-07T02:03:24.599925Z",
			"updated_at": "2026-04-29T10:39:54.767699Z",
			"deleted_at": null,
			"main_name": "BRONZE FLEETWOOD",
			"aliases": [
				"APT5 ",
				"DPD ",
				"Keyhole Panda ",
				"Mulberry Typhoon ",
				"Poisoned Flight ",
				"TG-2754 "
			],
			"source_name": "Secureworks:BRONZE FLEETWOOD",
			"tools": [
				"Binanen",
				"Comfoo",
				"Gh0st RAT",
				"Isastart",
				"Leouncia",
				"Marade",
				"OrcaRAT",
				"PCShare",
				"Protux",
				"Skeleton Key",
				"SlyPidgin",
				"VinSelf"
			],
			"source_id": "Secureworks",
			"reports": null
		}
	],
	"ts_created_at": 1777450911,
	"ts_updated_at": 1777459332,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/d5e140f3af7eb0fce85f56fc6476d520e7f2213c.pdf",
		"text": "https://archive.orkl.eu/d5e140f3af7eb0fce85f56fc6476d520e7f2213c.txt",
		"img": "https://archive.orkl.eu/d5e140f3af7eb0fce85f56fc6476d520e7f2213c.jpg"
	}
}