ACTAndroid C2 Tracker

20ba7a54e5dcf6ad6e5364cb…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

NFC Relay (provisional). Android NFC-relay fraud malware. Running on a victim’s phone, it reads contactless bank-card/tag data over NFC and relays it in real time over a WebSocket channel to an attacker-controlled device, which replays it at a payment terminal or ATM for fraudulent transactions (an NFSkimming / “NGate”-style technique). The relay C2 (where captured card APDUs, device status and the victim 4-digit PIN are pushed over a WebSocket) is wss://dashboard.gripe/ws-relay in the current build and ws://178.236.243.8:3050 in an earlier com.example.myemulator build. dashboardcloud.app is the operator WebView phishing-UI host (loaded via webView.loadUrl with a Portuguese ?step= flow and an “Android” JS bridge) - tracked as a panel, not the relay. api.dashboardcloud.app (painelStatusUrl) is assigned in the dex but never contacted, so it is NOT recorded as a C2. One widely repackaged build (identical classes.dex; lure label “Nfc Security”, package app.nfcsecurity.vault, Portuguese UI) stores its endpoints character-reversed and un-reverses them via UtilZ0Y480.decode, with source-to-sink bs.getWsUrl() -> SERVER_URL -> OkHttp newWebSocket(); it also carries a dormant base64+XOR alternate config (ws/web/api.cupworldcup.site) that the getters never use, so that is not treated as a live C2. Family label provisional. Indicators: wss://dashboard.gripe/ws-relay, https://dashboardcloud.app.

Recovered configuration

app_label
Nfc Security
dormant_alt_config
wss://ws.cupworldcup.site, https://web.cupworldcup.site, https://api.cupworldcup.site/api/status
package
com.cekuji.hamari5

Identification

SHA-256
20ba7a54e5dcf6ad6e5364cbaef6b79d09e5e81829c3f90a711c36815004a66e
MD5
1f7bc20e628ab1ba83caa6ec4e833abc

Observed

Families
NFC Relay (provisional)
First seen
2026-10-04

C2 configuration (2)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
dashboard.gripe/ws-relay domain - wss NFC Relay (provisional) 2026-10-04
dashboardcloud.app domain - https NFC Relay (provisional) 2026-10-04

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About NFC Relay (provisional)

Android NFC-relay fraud malware. Running on a victim's phone, it reads contactless bank-card/tag data over NFC and relays it in real time over a WebSocket channel to an attacker-controlled device, which replays it at a payment terminal or ATM for fraudulent transactions (an NFSkimming / "NGate"-style technique). The relay C2 (where captured card APDUs, device status and the victim 4-digit PIN are pushed over a WebSocket) is wss://dashboard.gripe/ws-relay in the current build and ws://178.236.243.8:3050 in an earlier com.example.myemulator build. dashboardcloud.app is the operator WebView phishing-UI host (loaded via webView.loadUrl with a Portuguese ?step= flow and an "Android" JS bridge) - tracked as a panel, not the relay. api.dashboardcloud.app (painelStatusUrl) is assigned in the dex but never contacted, so it is NOT recorded as a C2. One widely repackaged build (identical classes.dex; lure label "Nfc Security", package app.nfcsecurity.vault, Portuguese UI) stores its endpoints character-reversed and un-reverses them via UtilZ0Y480.decode, with source-to-sink bs.getWsUrl() -> SERVER_URL -> OkHttp newWebSocket(); it also carries a dormant base64+XOR alternate config (ws/web/api.cupworldcup.site) that the getters never use, so that is not treated as a live C2. Family label provisional.