Overview

overview

10

Static

static

10

YIFU-sghxbcg1681.apk

android-9-x86

1

YIFU-sghxbcg1681.apk

android-10-x64

1

YIFU-sghxbcg1681.apk

android-11-x64

6

Sharing

Copy URL Twitter E-mail

Errors

Reason
error processing APK: unexpected chunk type

General

  • Target
    YIFU-sghxbcg1681.apk
  • Size 8.7MB
  • Sample260721-phd1rsbl2v
  • SHA256 9a28ed8a091417ef5a48f3dc9533925586738093a7fce37f9711b0a5f09b07ec
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
trojaninfostealerratphantomcard

Malware Config

Signatures

  • Family: PhantomCard

    PhantomCard is a new Android NFC-based trojan targeting banking users in Brazil, first seen in August 2025.

    trojaninfostealerratphantomcard
  • PhantomCard payload 1 IoCs
  • Declares services with permission to bind to the system 1 IoCs
  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • YIFU-sghxbcg1681.apk
    .apk 8.7MB

YIFU-sghxbcg1681.apk

  • SHA256 9a28ed8a091417ef5a48f3dc9533925586738093a7fce37f9711b0a5f09b07ec
  • MD5 SHA1 SHA512 SSDEEP TLSH
android

  • PhantomCard payload

  • Untrusted Codesign Signers

    Codesigned file was signed by an untrusted entity.

File Signature issue

Digest
70a82325f8182888dc861f32117880ff1876451478d01d19a73e7e073e433148
Digest Algorithm
sha256
Digest Matches
Trusted
Not trusted
Signer
CN=client-708-247
DCLYnsmdivBFZ.yYgmWYOIjsQtW.eVXQRLAlAQiftB

Android Permissions

YIFU-sghxbcg1681.apk

Permissions

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.NFC

android.permission.INTERNET

android.permission.VIBRATE

DCLYnsmdivBFZ.yYgmWYOIjsQtW.eVXQRLAlAQiftB.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION