phantomcard | e27579b92fcad2f4fe96db7b5e7a7cdc41754a7cd126fcaf598d3f8d8c21c0f5[.]bin

General

Target
e27579b92fcad2f4fe96db7b5e7a7cdc41754a7cd126fcaf598d3f8d8c21c0f5.bin
Size 7.6MB
Sample251009-tmfsda1n18
SHA256 e27579b92fcad2f4fe96db7b5e7a7cdc41754a7cd126fcaf598d3f8d8c21c0f5
MD5 0ead9403e7eec1fac57f4043017813a4
SHA1 c6abb92b120099dcf246bcbe08ee3182c5e4f623
SHA512 21b6edc22e103e40aee2f3da6293862d06f7cf20a88613b470eb0e9d8b330392ee24a83f078a42d1ceeeff3b96359ae9b605e5d72699e516db24da57324bc165
SSDEEP 196608:gKpa7QLEqMiuhqOf47Pfr4eXnp/DM5P5A0mLfTLG:5M7QLEvhqOf473XnprMR5A0EnG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phantomcard

Malware Config

Extracted

Family

phantomcard

C2

http://app.nfuenglish2025.com/
http://app.nfuenglish2026.com/
http://nfu20050909.shop/
http://nfu20050910.shop/
https://nfu.rc888.uk/

Signatures

PhantomCard payload 1 IoCs

resource	yara_rule
sample	family_phantomcard

Phantomcard family
phantomcard

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by NFC services to bind with the system. Allows apps to interact with NFC hardware.	android.permission.BIND_NFC_SERVICE

Requests dangerous framework permissions 2 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM

File Explorer

e27579b92fcad2f4fe96db7b5e7a7cdc41754a7cd126fcaf598d3f8d8c21c0f5.bin

.apk 7.6MB

e27579b92fcad2f4fe96db7b5e7a7cdc41754a7cd126fcaf598d3f8d8c21c0f5.bin

SHA256 e27579b92fcad2f4fe96db7b5e7a7cdc41754a7cd126fcaf598d3f8d8c21c0f5
MD5 0ead9403e7eec1fac57f4043017813a4
SHA1 c6abb92b120099dcf246bcbe08ee3182c5e4f623
SHA512 21b6edc22e103e40aee2f3da6293862d06f7cf20a88613b470eb0e9d8b330392ee24a83f078a42d1ceeeff3b96359ae9b605e5d72699e516db24da57324bc165
SSDEEP 196608:gKpa7QLEqMiuhqOf47Pfr4eXnp/DM5P5A0mLfTLG:5M7QLEvhqOf473XnprMR5A0EnG
MD5 SHA1 SHA512 SSDEEP

android

PhantomCard payload

wkoezn.xchzfs.kgqbbr

Android Permissions

e27579b92fcad2f4fe96db7b5e7a7cdc41754a7cd126fcaf598d3f8d8c21c0f5.bin

Permissions

android.permission.NFC

android.permission.NFC_PREFERRED_PAYMENT_INFO

android.permission.WAKE_LOCK

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.USE_EXACT_ALARM

android.permission.VIBRATE

android.permission.SCHEDULE_EXACT_ALARM

wkoezn.xchzfs.kgqbbr.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

e27579b92fcad2f4fe96db7b5e7a7cdc41754a7cd126fcaf598d3f8d8c21c0f5.bin

nfc.share.nfcshare.TopicInputActivity

nfc.share.nfcshare.MainActivity

nfc.share.nfcshare.LoginActivity

nfc.share.nfcshare.SettingsActivity

nfc.share.nfcshare.HelpActivity

nfc.share.nfcshare.service.EmulationService

org.eclipse.paho.android.service.MqttService

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

e27579b92fcad2f4fe96db7b5e7a7cdc41754a7cd126fcaf598d3f8d8c21c0f5.bin

nfc.share.nfcshare.TopicInputActivity

nfc.share.nfcshare.MainActivity

nfc.share.nfcshare.LoginActivity

nfc.share.nfcshare.SettingsActivity

nfc.share.nfcshare.HelpActivity

nfc.share.nfcshare.service.EmulationService

org.eclipse.paho.android.service.MqttService

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

Android Permissions

e27579b92fcad2f4fe96db7b5e7a7cdc41754a7cd126fcaf598d3f8d8c21c0f5.bin