ACTAndroid C2 Tracker

ba7332459a0e4ab858c58e2b…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

NFC Relay (provisional). Android NFC-relay fraud malware. Running on a victim’s phone, it reads contactless bank-card/tag data over NFC and relays it in real time over a WebSocket channel to an attacker-controlled device, which replays it at a payment terminal or ATM for fraudulent transactions (an NFSkimming / “NGate”-style technique). Observed C2 infrastructure includes dashboardcloud.app / api.dashboardcloud.app, dashboard.gripe and 178.236.243.8. Family label provisional. Indicators: wss://dashboard.gripe/ws-relay, https://dashboardcloud.app, https://api.dashboardcloud.app/api/status.

Recovered configuration

backend_urls
https://dashboardcloud.app, https://api.dashboardcloud.app/api/status
build_id
2363b211bfb1
config_id
e69ea27c
relay_c2
wss://dashboard.gripe/ws-relay

Source: string-reversed URLs in dex (bs config, UtilZ0Y480.decode = reverse)

Identification

SHA-256
ba7332459a0e4ab858c58e2b84ae7f9ada027886b2322a67a2b221ff03317123
MD5
ede936597bf947768851d7c61f9a326f

Observed

Families
NFC Relay (provisional)
First seen
–

C2 configuration (3)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
api.dashboardcloud.app/api/status domain - https NFC Relay (provisional) –
dashboard.gripe/ws-relay domain - wss NFC Relay (provisional) –
dashboardcloud.app domain - https NFC Relay (provisional) –

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
216418c8a33294247844a2f1681448a97e91ab862040238991b801d2d0557bf1

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About NFC Relay (provisional)

Android NFC-relay fraud malware. Running on a victim's phone, it reads contactless bank-card/tag data over NFC and relays it in real time over a WebSocket channel to an attacker-controlled device, which replays it at a payment terminal or ATM for fraudulent transactions (an NFSkimming / "NGate"-style technique). Observed C2 infrastructure includes dashboardcloud.app / api.dashboardcloud.app, dashboard.gripe and 178.236.243.8. Family label provisional.