Overview

overview

10

Static

static

10

nfu.apk

android-13-x64

1

Resubmissions

20/03/2026, 04:37

260320-e8ysrah12t10

22/09/2025, 06:37

250922-hdyq2ser3s10

Sharing

Copy URL Twitter E-mail

General

  • Target
    nfu.apk
  • Size 7.6MB
  • Sample260320-e8ysrah12t
  • SHA256 a3488ace6a711d246b7c90fc9d557628a3bd5f7ab1ca32b36bece6864d24c1d5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
phantomcard

Malware Config

Extracted

Family

  • phantomcard

C2

  • http://app.nfuenglish2025.com/

  • http://app.nfuenglish2026.com/

  • http://nfu20050909.shop/

  • http://nfu20050910.shop/

  • https://nfu.rc888.uk/

Signatures

  • PhantomCard payload 1 IoCs
  • Phantomcard family
    phantomcard
  • Declares services with permission to bind to the system 1 IoCs
  • Requests dangerous framework permissions 2 IoCs
  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • nfu.apk
    .apk 7.6MB

nfu.apk

  • SHA256 a3488ace6a711d246b7c90fc9d557628a3bd5f7ab1ca32b36bece6864d24c1d5
  • MD5 SHA1 SHA512 SSDEEP TLSH
android

  • PhantomCard payload

  • Untrusted Codesign Signers

    Codesigned file was signed by an untrusted entity.

File Signature issue

Digest
0ed624fedfcc44bebf09129b97be43022c9778fcdd473ffa4fc165337bef484c
Digest Algorithm
sha256
Digest Matches
Trusted
Not trusted
Signer
CN=eaat,OU=bc1758518677732,O=mq1758518677732,L=xinjiang,ST=xinjiang,C=xinjiang
haiozr.soecdb.aamope

Android Permissions

nfu.apk

Permissions

android.permission.NFC

android.permission.NFC_PREFERRED_PAYMENT_INFO

android.permission.WAKE_LOCK

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.USE_EXACT_ALARM

android.permission.VIBRATE

android.permission.SCHEDULE_EXACT_ALARM

haiozr.soecdb.aamope.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION