ACTAndroid C2 Tracker

20ba7a54e5dcf6ad6e5364cb…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

NFC Relay (provisional). NFC Relay (provisional) is Android NFC-relay card-fraud malware (NGate / NFSkimming style). On the victim’s phone it reads contactless EMV card data over NFC and relays it live over a WebSocket to the operator, who replays it at a payment terminal or ATM.

What it does

  • Reads contactless EMV card APDUs over NFC (IsoDep, accept-any-AID) and relays them, with device status and the victim’s 4-digit PIN, to the operator in real time.
  • Drives the victim through a WebView phishing flow (card-tap prompt, PIN entry) while the relay runs.

Builds and C2 (binary-verified)

  • “Nfc Security” build (12 samples, identical dex; package app.nfcsecurity.vault, Portuguese UI). Endpoints are stored character-reversed and recovered via UtilZ0Y480.decode. Relay C2 wss://dashboard.gripe/ws-relay (source-to-sink: bs.getWsUrl supplies SERVER_URL, passed to OkHttp newWebSocket; APDUs and PIN sent via vo5bwh.sendResponse / sendPin). The phishing UI loads from https://dashboardcloud.app (ReFragment.goStep, Portuguese ?step= flow) and is tracked as a panel, not the relay.
  • “Банк России” build (656eee1e, package com.example.myemulator, Russian lure). Relays to a raw-socket C2 ws://178.236.243.8:3050.

Not treated as C2

  • api.dashboardcloud.app (painelStatusUrl) is assigned in the dex but never contacted.
  • A dormant base64+XOR alternate config (cupworldcup.site) is present but unused by the getters.
  • No Firebase or other backend is present in either build.

Family label provisional. Indicators: wss://dashboard.gripe/ws-relay, https://dashboardcloud.app.

Recovered configuration

app_label
Nfc Security
dormant_alt_config
wss://ws.cupworldcup.site, https://web.cupworldcup.site, https://api.cupworldcup.site/api/status
package
com.cekuji.hamari5

Identification

SHA-256
20ba7a54e5dcf6ad6e5364cbaef6b79d09e5e81829c3f90a711c36815004a66e
MD5
1f7bc20e628ab1ba83caa6ec4e833abc

Observed

Families
NFC Relay (provisional)
First seen
2026-10-04

C2 configuration (2)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
dashboard.gripe/ws-relay domain - wss NFC Relay (provisional) 2026-10-04
dashboardcloud.app domain - https NFC Relay (provisional) 2026-10-04

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About NFC Relay (provisional)

**NFC Relay (provisional)** is Android NFC-relay card-fraud malware (NGate / NFSkimming style). On the victim's phone it reads contactless EMV card data over NFC and relays it live over a WebSocket to the operator, who replays it at a payment terminal or ATM. **What it does** - Reads contactless **EMV card APDUs** over NFC (`IsoDep`, accept-any-AID) and relays them, with device status and the victim's **4-digit PIN**, to the operator in real time. - Drives the victim through a WebView phishing flow (card-tap prompt, PIN entry) while the relay runs. **Builds and C2 (binary-verified)** - **"Nfc Security" build** (12 samples, identical dex; package `app.nfcsecurity.vault`, Portuguese UI). Endpoints are stored character-reversed and recovered via `UtilZ0Y480.decode`. Relay C2 `wss://dashboard.gripe/ws-relay` (source-to-sink: `bs.getWsUrl` supplies `SERVER_URL`, passed to OkHttp `newWebSocket`; APDUs and PIN sent via `vo5bwh.sendResponse` / `sendPin`). The phishing UI loads from `https://dashboardcloud.app` (`ReFragment.goStep`, Portuguese `?step=` flow) and is tracked as a **panel, not the relay**. - **"Банк России" build** (`656eee1e`, package `com.example.myemulator`, Russian lure). Relays to a raw-socket C2 `ws://178.236.243.8:3050`. **Not treated as C2** - `api.dashboardcloud.app` (`painelStatusUrl`) is assigned in the dex but never contacted. - A dormant base64+XOR alternate config (`cupworldcup.site`) is present but unused by the getters. - No Firebase or other backend is present in either build. Family label provisional.