supercardx | 6dd602166a11823229fbf9f01e14bdfe9691ed75c493f7d8fd0b2bb31aeefd6a

Resubmissions

30/06/2026, 10:58

260630-m29knsdt5y10

29/06/2026, 12:17

260629-pgcfjsey2m10

Analysis

max time kernel
25s
max time network
150s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
29/06/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lobstor.apk
Size 1.4MB
Sample260629-pgcfjsey2m
SHA256 6dd602166a11823229fbf9f01e14bdfe9691ed75c493f7d8fd0b2bb31aeefd6a
MD5 ce8b23a2d1ea1c9e72a1219532c84bd1
SHA1 07a8ec19681f917f4332f5185a331f5f4b2d0f33
SHA512 189bc66737a2ea9fc703188945bb2a9082468ea4a3fa0d5cfb1d920e0c1ab8479005470c9a2b4b21c0075cf1f490c5f6605fa619b67840b05d0d3adbcfc8baff
SSDEEP 24576:V/tTFb/o7CinL9kuPBod1PjlJgC7ItNJRYIrD92r/WwLsjaEzK7srXD4qsy:HUNLNGjvgC7CNJRYo8rFYjbO7srXd
TLSH
T18065CF47FB59E87EC4F382374A76063A55068C668743D7838959733C2DBB9C05E8AEC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion supercardx infostealer rat trojan

Malware Config

Signatures

Family: SuperCardX
SuperCardX is an Android malware using NFC relay to steal payment card data first seen in April 2025.
trojan infostealer rat supercardx

SuperCardX payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_supercardx

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.syncler.installer

Requests dangerous framework permissions 4 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to record audio.	android.permission.RECORD_AUDIO

com.syncler.installer
1⤵
- Checks the application is allowed to request package installs through the package installer
PID:5032

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

download.apk

Path /data/data/com.syncler.installer/cache/download.apk
Size 106.2MB
SHA256 4f30017cd593ae3f3f6d24e6ad5d3536b255e3464c35a11a98605cb70664db02
MD5 fe0aab03c8533658d4150ed0d5124dc6
SHA1 16c2d8014da847ccdb0d81b34f62f42e3a347f04
SHA512 7193bf0af80fa59325092d7266484ec9d5f1f736fb9f0cf7fe516a13adbc0a9ea2daa0f9c81467660435e0c49fdf9979ad1d32fd656f7ce9470480d23205333f
SSDEEP 3145728:fAYAs7J0x0xst2C/saV1isD7Vhy8BlE1meQxRB:vt0x0xLS1iehyx4V
TLSH
T1FE383395BBCC959EC93BA4B308059232910D9CBA8A1E935F7514738C7C739E43B46FCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download