> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# IOC Alert: apk.hook Botnet C2
- URL: https://darkwebinformer.com/ioc-alert-apk-hook-botnet-c2/
- Published: 2025-08-30T01:02:40.000Z
- Updated: 2025-09-04T22:19:42.000Z
- Author: Dark Web Informer
- Tags: IOC

📖 **Overview**  
A new domain-based indicator has been identified linked to botnet command-and-control infrastructure for *apk.hook* (HookBot). The domain, hosted under Hetzner (AS24940), is tied to ERMAC v3.0 activity and represents a high-confidence threat to Android devices targeted by banking trojans.

---

📌 **Key Details**

| Field           | Information                              |
| --------------- | ---------------------------------------- |
| **Type**        | Domain                                   |
| **Indicator**   | www.libertydroid-magma\[.\]top           |
| **Threat Type** | Botnet C2                                |
| **Malware**     | apk.hook                                 |
| **Confidence**  | 100%                                     |
| **Date**        | 30 Aug 2025 – 00:01:04 UTC               |
| **Tags**        | AS24940, C2, Censys, HETZNER-AS, HookBot |
| **Reporter**    | DonPasci                                 |

---

🔎 **URLScan Result**

- **Page Title:** ERMAC 3.0 PANEL
- **Screenshot:** [View Screenshot](https://urlscan.io/screenshots/0198f84c-08c3-72e9-a200-045df33aa813.png)
- **Result:** [View URLScan Report](https://urlscan.io/result/0198f84c-08c3-72e9-a200-045df33aa813/)

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2025/08/78652397856928735698723759861-2.jpg)

---

📡 **Related Intelligence**

- **WHOIS Record:** [WHOIS Lookup](https://who.is/whois/www.libertydroid-magma.top)
- **VirusTotal Report:** [VirusTotal Domain Report](https://www.virustotal.com/gui/domain/www.libertydroid-magma.top)
- **Censys Reference:** [Censys Search](https://search.censys.io/hosts/178.63.215.79+www.libertydroid-magma.top)

---

🛡️ **Defensive Guidance**

- Block `www.libertydroid-magma[.]top` at DNS, proxy, and endpoint levels.
- Monitor for outbound traffic to Hetzner-hosted infrastructure (AS24940).
- Hunt for *apk.hook* artifacts on mobile endpoints (APK sideload traces, suspicious accessibility service abuse).
- Review mobile MDM and firewall logs for attempts to connect to ERMAC 3.0 C2 panels.