C2Tracker

656eee1ea18dee0fe926acc1…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

NFC Relay (provisional) — an Android malware family, distributed as com.example.myemulator, self-signed as “App Factory”. Communicates with 1 operator endpoint. NFCGate-style contactless card-relay fraud app (package com.example.myemulator; requests only NFC + INTERNET). An OkHttp WebSocket client relays captured APDU traffic to ws://178.236.243.8:3050, with role markers app_type=contribution and device_type=emitter (the emitter/mule side of an NFC relay). The C2 was recovered in plaintext from classes.dex (binary-verified). This is a plaintext-URL variant, so the reversed-URL NFC Relay decoder does not auto-match it. Indicators: ws://178.236.243.8:3050.

Recovered configuration

package
com.example.myemulator

Identification

SHA-256
656eee1ea18dee0fe926acc183d97d1ff6865e2b2cad9e2670eeb3f504e326c3
MD5
14eacab25abfb0a6afe95096fb532f55

Observed

Families
NFC Relay (provisional)
First seen
2026-10-07

APK metadata

Summary

Type
Android · APK
Package
com.example.myemulator
Main activity
com.example.myemulator.MainActivity
Internal version
2
Displayed version
1.1
Min SDK
21
Target SDK
35

Signing certificate

Valid from
2026-03-10 16:00:58
Valid to
2053-07-26 16:00:58
Serial
1384ab31e0493139
Thumbprint
a193514e533a0759c43f4a5ea3714f25e15ae921
Subject
C:GB, CN:David Brown, L:London, O:App Factory, ST:England, OU:Mobile Development
Issuer
C:GB, CN:David Brown, L:London, O:App Factory, ST:England, OU:Mobile Development

Permissions (4)

android.permission.ACCESS_NETWORK_STATEandroid.permission.INTERNETandroid.permission.NFCcom.example.myemulator.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Activities (2)

  • com.example.myemulator.EmulatorActivity
  • com.example.myemulator.MainActivity

Services (1)

  • com.example.myemulator.MyHostApduService

Receivers (1)

  • androidx.profileinstaller.ProfileInstallReceiver

Providers (1)

  • androidx.startup.InitializationProvider

Intent filters — actions

android.nfc.cardemulation.action.HOST_APDU_SERVICEandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILE

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
178.236.243.8 ip 3050 ws NFC Relay (provisional) 2026-10-07

Signing certificate

Subject CN
David Brown
Issuer CN
David Brown
Fingerprint
93c6196f270594a3011378729ca996fe64789bf5a9644361a2214a67ce16c615

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.