ACTAndroid C2 Tracker

aed16211d04c1d2a43cdcfdc…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

NFC Relay (provisional). NFC Relay (provisional) is Android NFC-relay card-fraud malware (NGate / NFSkimming style). On the victim’s phone it reads contactless EMV card data over NFC and relays it live over a WebSocket to the operator, who replays it at a payment terminal or ATM.

What it does

  • Reads contactless EMV card APDUs over NFC (IsoDep, accept-any-AID) and relays them, with device status and the victim’s 4-digit PIN, to the operator in real time.
  • Drives the victim through a WebView phishing flow (card-tap prompt, PIN entry) while the relay runs.

Builds and C2 (binary-verified)

  • “Nfc Security” build (12 samples, identical dex; package app.nfcsecurity.vault, Portuguese UI). Endpoints are stored character-reversed and recovered via UtilZ0Y480.decode. Relay C2 wss://dashboard.gripe/ws-relay (source-to-sink: bs.getWsUrl supplies SERVER_URL, passed to OkHttp newWebSocket; APDUs and PIN sent via vo5bwh.sendResponse / sendPin). The phishing UI loads from https://dashboardcloud.app (ReFragment.goStep, Portuguese ?step= flow) and is tracked as a panel, not the relay.
  • “Банк России” build (656eee1e, package com.example.myemulator, Russian lure). Relays to a raw-socket C2 ws://178.236.243.8:3050.

Not treated as C2

  • api.dashboardcloud.app (painelStatusUrl) is assigned in the dex but never contacted.
  • A dormant base64+XOR alternate config (cupworldcup.site) is present but unused by the getters.
  • No Firebase or other backend is present in either build.

Family label provisional. Indicators: wss://dashboard.gripe/ws-relay, https://dashboardcloud.app.

Recovered configuration

app_label
Nfc Security
dormant_alt_config
wss://ws.cupworldcup.site, https://web.cupworldcup.site, https://api.cupworldcup.site/api/status
package
com.zeme.gabe0

Identification

SHA-256
aed16211d04c1d2a43cdcfdc873c47378b4c9258e09c35e184c50509199f5d71
MD5
0075506027d676cb1607069094b12c69

Observed

Families
NFC Relay (provisional)
First seen
2026-10-11

C2 configuration (2)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
dashboard.gripe/ws-relay domain - wss NFC Relay (provisional) 2026-10-11
dashboardcloud.app domain - https NFC Relay (provisional) 2026-10-11

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About NFC Relay (provisional)

**NFC Relay (provisional)** is Android NFC-relay card-fraud malware (NGate / NFSkimming style). On the victim's phone it reads contactless EMV card data over NFC and relays it live over a WebSocket to the operator, who replays it at a payment terminal or ATM. **What it does** - Reads contactless **EMV card APDUs** over NFC (`IsoDep`, accept-any-AID) and relays them, with device status and the victim's **4-digit PIN**, to the operator in real time. - Drives the victim through a WebView phishing flow (card-tap prompt, PIN entry) while the relay runs. **Builds and C2 (binary-verified)** - **"Nfc Security" build** (12 samples, identical dex; package `app.nfcsecurity.vault`, Portuguese UI). Endpoints are stored character-reversed and recovered via `UtilZ0Y480.decode`. Relay C2 `wss://dashboard.gripe/ws-relay` (source-to-sink: `bs.getWsUrl` supplies `SERVER_URL`, passed to OkHttp `newWebSocket`; APDUs and PIN sent via `vo5bwh.sendResponse` / `sendPin`). The phishing UI loads from `https://dashboardcloud.app` (`ReFragment.goStep`, Portuguese `?step=` flow) and is tracked as a **panel, not the relay**. - **"Банк России" build** (`656eee1e`, package `com.example.myemulator`, Russian lure). Relays to a raw-socket C2 `ws://178.236.243.8:3050`. **Not treated as C2** - `api.dashboardcloud.app` (`painelStatusUrl`) is assigned in the dex but never contacted. - A dormant base64+XOR alternate config (`cupworldcup.site`) is present but unused by the getters. - No Firebase or other backend is present in either build. Family label provisional.