phantomcard | 038c5da855386da6029b77e3effcf458f49433d5faac6587e2344eedbf526a69[.]bin

Resubmissions

03/11/2025, 16:43

251103-t8q58shk4z10

03/11/2025, 16:42

251103-t7wdkatjdp10

03/11/2025, 16:41

251103-t7g6yagy3c10

09/10/2025, 16:09

251009-tlq7qagm2110

Sharing

Copy URL Twitter E-mail

General

Target
038c5da855386da6029b77e3effcf458f49433d5faac6587e2344eedbf526a69.bin
Size 7.6MB
Sample251009-tlq7qagm21
SHA256 038c5da855386da6029b77e3effcf458f49433d5faac6587e2344eedbf526a69
MD5 05292a398730d9ba19568e2ffbf99db4
SHA1 6f8befa570dc9348d2956105b7e6e6f11bd014ae
SHA512 c1cbb2926f0325b6642c7ed53f126bc8959e47423f6556ed40c60e8a0df9b33e7e51a08bf56bda3309f1eb00c90429f0148c2e04822c6fe0e53902e069399bf1
SSDEEP 196608:gKpa7QLEqMyuhqOf47PfX4eXDhLDM5P5A0mGfTXzH:5M7QLE3hqOf47LXDhnMR5A0JzzH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phantomcard

Malware Config

Extracted

Family

phantomcard

http://app.nfuenglish2025.com/
http://app.nfuenglish2026.com/
http://nfu20050909.shop/
http://nfu20050910.shop/
https://nfu.rc888.uk/

Signatures

PhantomCard payload 1 IoCs

resource	yara_rule
sample	family_phantomcard

Phantomcard family
phantomcard

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by NFC services to bind with the system. Allows apps to interact with NFC hardware.	android.permission.BIND_NFC_SERVICE

Requests dangerous framework permissions 2 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM

File Explorer

038c5da855386da6029b77e3effcf458f49433d5faac6587e2344eedbf526a69.bin

.apk 7.6MB

038c5da855386da6029b77e3effcf458f49433d5faac6587e2344eedbf526a69.bin

SHA256 038c5da855386da6029b77e3effcf458f49433d5faac6587e2344eedbf526a69
MD5 05292a398730d9ba19568e2ffbf99db4
SHA1 6f8befa570dc9348d2956105b7e6e6f11bd014ae
SHA512 c1cbb2926f0325b6642c7ed53f126bc8959e47423f6556ed40c60e8a0df9b33e7e51a08bf56bda3309f1eb00c90429f0148c2e04822c6fe0e53902e069399bf1
SSDEEP 196608:gKpa7QLEqMyuhqOf47PfX4eXDhLDM5P5A0mGfTXzH:5M7QLE3hqOf47LXDhnMR5A0JzzH
MD5 SHA1 SHA512 SSDEEP

android

PhantomCard payload

rqptzi.ptksee.gfjhgj

Android Permissions

038c5da855386da6029b77e3effcf458f49433d5faac6587e2344eedbf526a69.bin

Permissions

android.permission.NFC

android.permission.NFC_PREFERRED_PAYMENT_INFO

android.permission.WAKE_LOCK

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.USE_EXACT_ALARM

android.permission.VIBRATE

android.permission.SCHEDULE_EXACT_ALARM

rqptzi.ptksee.gfjhgj.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

038c5da855386da6029b77e3effcf458f49433d5faac6587e2344eedbf526a69.bin

nfc.share.nfcshare.TopicInputActivity

nfc.share.nfcshare.MainActivity

nfc.share.nfcshare.LoginActivity

nfc.share.nfcshare.SettingsActivity

nfc.share.nfcshare.HelpActivity

nfc.share.nfcshare.service.EmulationService

org.eclipse.paho.android.service.MqttService

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider