ACTAndroid C2 Tracker

d811ea66deb1a40cceb01f7d…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

NFC Relay (provisional). NFC Relay (provisional) is Android NFC-relay card-fraud malware (NGate / NFSkimming style). On the victim’s phone it reads contactless EMV card data over NFC and relays it live over a WebSocket to the operator, who replays it at a payment terminal or ATM.

What it does

  • Reads contactless EMV card APDUs over NFC (IsoDep, accept-any-AID) and relays them, with device status and the victim’s 4-digit PIN, to the operator in real time.
  • Drives the victim through a WebView phishing flow (card-tap prompt, PIN entry) while the relay runs.

Builds and C2 (binary-verified)

  • “Nfc Security” build (12 samples, identical dex; package app.nfcsecurity.vault, Portuguese UI). Endpoints are stored character-reversed and recovered via UtilZ0Y480.decode. Relay C2 wss://dashboard.gripe/ws-relay (source-to-sink: bs.getWsUrl supplies SERVER_URL, passed to OkHttp newWebSocket; APDUs and PIN sent via vo5bwh.sendResponse / sendPin). The phishing UI loads from https://dashboardcloud.app (ReFragment.goStep, Portuguese ?step= flow) and is tracked as a panel, not the relay.
  • “Банк России” build (656eee1e, package com.example.myemulator, Russian lure). Relays to a raw-socket C2 ws://178.236.243.8:3050.

Not treated as C2

  • api.dashboardcloud.app (painelStatusUrl) is assigned in the dex but never contacted.
  • A dormant base64+XOR alternate config (cupworldcup.site) is present but unused by the getters.
  • No Firebase or other backend is present in either build.

Family label provisional. Indicators: wss://dashboard.gripe/ws-relay, https://dashboardcloud.app.

Recovered configuration

app_label
Nfc Security
dormant_alt_config
wss://ws.cupworldcup.site, https://web.cupworldcup.site, https://api.cupworldcup.site/api/status
package
com.tele.zezezu2

Identification

SHA-256
d811ea66deb1a40cceb01f7df700b4ccc7bd6b546b91b0c3bd175e07ea1fe911
MD5
44df3c597031d81cb2036ddc7a47d672

Observed

Families
NFC Relay (provisional)
First seen
2026-10-11

C2 configuration (2)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
dashboard.gripe/ws-relay domain - wss NFC Relay (provisional) 2026-10-11
dashboardcloud.app domain - https NFC Relay (provisional) 2026-10-11

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About NFC Relay (provisional)

**NFC Relay (provisional)** is Android NFC-relay card-fraud malware (NGate / NFSkimming style). On the victim's phone it reads contactless EMV card data over NFC and relays it live over a WebSocket to the operator, who replays it at a payment terminal or ATM. **What it does** - Reads contactless **EMV card APDUs** over NFC (`IsoDep`, accept-any-AID) and relays them, with device status and the victim's **4-digit PIN**, to the operator in real time. - Drives the victim through a WebView phishing flow (card-tap prompt, PIN entry) while the relay runs. **Builds and C2 (binary-verified)** - **"Nfc Security" build** (12 samples, identical dex; package `app.nfcsecurity.vault`, Portuguese UI). Endpoints are stored character-reversed and recovered via `UtilZ0Y480.decode`. Relay C2 `wss://dashboard.gripe/ws-relay` (source-to-sink: `bs.getWsUrl` supplies `SERVER_URL`, passed to OkHttp `newWebSocket`; APDUs and PIN sent via `vo5bwh.sendResponse` / `sendPin`). The phishing UI loads from `https://dashboardcloud.app` (`ReFragment.goStep`, Portuguese `?step=` flow) and is tracked as a **panel, not the relay**. - **"Банк России" build** (`656eee1e`, package `com.example.myemulator`, Russian lure). Relays to a raw-socket C2 `ws://178.236.243.8:3050`. **Not treated as C2** - `api.dashboardcloud.app` (`painelStatusUrl`) is assigned in the dex but never contacted. - A dormant base64+XOR alternate config (`cupworldcup.site`) is present but unused by the getters. - No Firebase or other backend is present in either build. Family label provisional.