phantomcard | nfu[.]apk

General

Target
nfu.apk
Size 7.6MB
Sample251001-2d2x9asyby
SHA256 038c5da855386da6029b77e3effcf458f49433d5faac6587e2344eedbf526a69
MD5 05292a398730d9ba19568e2ffbf99db4
SHA1 6f8befa570dc9348d2956105b7e6e6f11bd014ae
SHA512 c1cbb2926f0325b6642c7ed53f126bc8959e47423f6556ed40c60e8a0df9b33e7e51a08bf56bda3309f1eb00c90429f0148c2e04822c6fe0e53902e069399bf1
SSDEEP 196608:gKpa7QLEqMyuhqOf47PfX4eXDhLDM5P5A0mGfTXzH:5M7QLE3hqOf47LXDhnMR5A0JzzH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

PhantomCard payload 1 IoCs

resource	yara_rule
sample	family_phantomcard

Phantomcard family
phantomcard

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by NFC services to bind with the system. Allows apps to interact with NFC hardware.	android.permission.BIND_NFC_SERVICE

Requests dangerous framework permissions 2 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM

File Explorer

nfu.apk

.apk 7.6MB

nfu.apk

SHA256 038c5da855386da6029b77e3effcf458f49433d5faac6587e2344eedbf526a69
MD5 05292a398730d9ba19568e2ffbf99db4
SHA1 6f8befa570dc9348d2956105b7e6e6f11bd014ae
SHA512 c1cbb2926f0325b6642c7ed53f126bc8959e47423f6556ed40c60e8a0df9b33e7e51a08bf56bda3309f1eb00c90429f0148c2e04822c6fe0e53902e069399bf1
SSDEEP 196608:gKpa7QLEqMyuhqOf47PfX4eXDhLDM5P5A0mGfTXzH:5M7QLE3hqOf47LXDhnMR5A0JzzH
MD5 SHA1 SHA512 SSDEEP

android

PhantomCard payload

rqptzi.ptksee.gfjhgj

Android Permissions

nfu.apk

Permissions

android.permission.NFC

android.permission.NFC_PREFERRED_PAYMENT_INFO

android.permission.WAKE_LOCK

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.USE_EXACT_ALARM

android.permission.VIBRATE

android.permission.SCHEDULE_EXACT_ALARM

rqptzi.ptksee.gfjhgj.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

nfu.apk

nfc.share.nfcshare.TopicInputActivity

nfc.share.nfcshare.MainActivity

nfc.share.nfcshare.LoginActivity

nfc.share.nfcshare.SettingsActivity

nfc.share.nfcshare.HelpActivity

nfc.share.nfcshare.service.EmulationService

org.eclipse.paho.android.service.MqttService

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

Sharing

General

Malware Config

Signatures

File Explorer

nfu.apk

nfc.share.nfcshare.TopicInputActivity

nfc.share.nfcshare.MainActivity

nfc.share.nfcshare.LoginActivity

nfc.share.nfcshare.SettingsActivity

nfc.share.nfcshare.HelpActivity

nfc.share.nfcshare.service.EmulationService

org.eclipse.paho.android.service.MqttService

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

Android Permissions

nfu.apk