C2Tracker

289c1cb66d0111a82a8c133a…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

NFC Relay (provisional). NGate-style NFC relay: relays contactless EMV payment-card APDUs (Visa/Mastercard/Amex AIDs in assets/aids.txt) from the victim to the operator over a WebSocket. C2/backend URLs are stored string-reversed and reversed at runtime. The wss:// endpoint is the relay C2; the https:// hosts are the operator backend/status panel. Label provisional. Indicators: wss://dashboard.gripe/ws-relay, https://dashboardcloud.app, https://api.dashboardcloud.app/api/status.

Recovered configuration

backend_urls
https://dashboardcloud.app, https://api.dashboardcloud.app/api/status
build_id
2363b211bfb1
config_id
e69ea27c
relay_c2
wss://dashboard.gripe/ws-relay

Source: string-reversed URLs in dex (bs config, UtilZ0Y480.decode = reverse)

NGate-style NFC relay: relays contactless EMV payment-card APDUs (Visa/Mastercard/Amex AIDs in assets/aids.txt) from the victim to the operator over a WebSocket. C2/backend URLs are stored string-reversed and reversed at runtime. The wss:// endpoint is the relay C2; the https:// hosts are the operator backend/status panel. Label provisional.

Identification

SHA-256
289c1cb66d0111a82a8c133a9cf0d537045bbbc05c83ede07dc2119549333d67
MD5
5af2f63ee18d51bde5a02af814cff413

Observed

Families
NFC Relay (provisional)
First seen
2026-10-02

C2 configuration (3)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
api.dashboardcloud.app/api/status domain — https NFC Relay (provisional) 2026-10-02
dashboard.gripe/ws-relay domain — wss NFC Relay (provisional) 2026-10-02
dashboardcloud.app domain — https NFC Relay (provisional) 2026-10-02

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
2a550bfbc06d670e5ecc3c231c7dbd16180888ba9a5d3c2982726b29d5c0bacc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.