supercardx | 2c6b914f9e27482152f704d3baea6c8030da859c9f5807be4e615680f93563a0

Analysis

max time kernel
7s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260104-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260104-enlocale:en-usos:android-11-x64system
submitted
29/01/2026, 15:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2c6b914f9e27482152f704d3baea6c8030da859c9f5807be4e615680f93563a0.apk
Size 5.1MB
Sample260129-sv2jdae12f
SHA256 2c6b914f9e27482152f704d3baea6c8030da859c9f5807be4e615680f93563a0
MD5 f949eadea1b78aa68c1a393019052bcb
SHA1 80e53f3fa70470f1cd659514315be6450b1edc58
SHA512 75efc7a91fee3f74cc5c35d8e66d8ed2b0858609ce6c8ee9fb1f034a17552d5e60401a714f6ffa5a56700b8b0cec8c0ffc9ffacd1f7112e872eee1aef93e3800
SSDEEP 98304:vN+q71y7oZU7t2oCsjzg2ug/v43zPois2dtU3bmKImVmMgMWCdOfFZTM/:vxurzjkOnO7PD+VmOWSOo/
TLSH
T17A36024DB74DBA2EC87F11734E56C2B222568C1B8E83D70B6844375CE877AD84F59AC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

evasion supercardx impact infostealer rat trojan

Malware Config

Signatures

SuperCardX
SuperCardX is an Android malware using NFC relay to steal payment card data first seen in April 2025.
trojan infostealer rat supercardx
Supercardx family
supercardx

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4735	io.dxpay.remotenfc.supercard11
/system_ext/framework/androidx.window.sidecar.jar	4735	io.dxpay.remotenfc.supercard11

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	io.dxpay.remotenfc.supercard11

io.dxpay.remotenfc.supercard11
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4735

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/io.dxpay.remotenfc.supercard11/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 d7d40fa6b4758da8aa657fd2db13a48bd5f98a0cd90ccbdae1cda5a4bc2f23f1
MD5 c322e658c0a42416ac459f7d509960d3
SHA1 759c76dcff902266d45ecaadb51ce29dd597b7bd
SHA512 82eaa27eb6e7035a0761c0ae3879e0f57e3a778c393c8ac463202cc5f2773f7653b8dd265fcc8c80d49cc7ce46fd2d684a451c7e59f5d3cfcf6bd2b85c6292f9
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/io.dxpay.remotenfc.supercard11/primary.prof
Size 2KB
SHA256 2c8b11d27fd5ece3d529fabb4eb1f7a71cf563bf49124a432c03407eb4aa56bc
MD5 3f90b38fd8fc4329f3273eb071551c1c
SHA1 85e89592388674e56c2ad61dc0157dc4c03a8523
SHA512 6978b0b6f5ea05f0991ce2f2e10b0169ed5d5fdf1a94083e5ed9a796329293a2970695f79e7d312024e42f5c8692c1608a1ada9e4e0522416b984f29600e3e85
TLSH
T15D514AFAC4D62B468130454B12C5FAFE66B106CCA5CDF952A05E87F9304FC606CB49E2
MD5 SHA1 SHA512 TLSH