ev-flow · haeter525 · Jun 24, 2026 · Jun 22, 2026 · Jun 24, 2026 · Jun 24, 2026
diff --git a/README.md b/README.md
@@ -66,6 +66,9 @@
     <td><img src="https://github.com/user-attachments/assets/03b5a2e2-7dda-4fb7-8462-d2a83bf38bbb" width="310"></td>
     <td><img src="https://github.com/user-attachments/assets/aa51bd06-de3e-4bcc-95cd-22ecc8b27c01" width="310"></td>
   </tr>
+  <tr>
+      <td><img src="https://github.com/user-attachments/assets/986d23eb-48de-459f-9714-f4685fd3e696" width="310"></td>
+  </tr>
 </table>
 
 
@@ -89,6 +92,7 @@
 | BRATA       | Banking trojan with remote control and anti-analysis capabilities. | 1. Perform overlay attacks to steal banking credentials.<br>2. Abuse Accessibility services for device control.<br>3. Intercept SMS messages (OTP).<br>4. Execute factory reset or device wipe commands. | [View](https://quark-engine.readthedocs.io/en/latest/quark_rules.html#new-quark-rules-for-brata) |
 | Cerberus    | Banking trojan targeting financial credentials through overlay and device control. | 1. Perform overlay attacks to steal credentials.<br>2. Abuse Accessibility services.<br>3. Log user input (keylogging).<br>4. Enable remote control via C2. | [View](https://quark-engine.readthedocs.io/en/latest/quark_rules.html#new-quark-rules-for-cerberus) |
 | SuperCardX  | NFC relay malware enabling contactless payment fraud. | 1. Read NFC payment card data.<br>2. Relay NFC transactions to attacker-controlled devices.<br>3. Communicate with C2 servers.<br>4. Facilitate unauthorized contactless payments. | [View](https://quark-engine.readthedocs.io/en/latest/quark_rules.html#new-quark-rules-for-supercardx) |
+| NGate       | NFC-based malware enabling relay attacks and payment fraud. | 1. Read NFC payment card data.<br>2. Relay NFC communications to attacker-controlled devices.<br>3. Communicate with C2 servers.<br>4. Facilitate unauthorized contactless payments. | [View](https://quark-engine.readthedocs.io/en/latest/quark_rules.html#new-quark-rules-for-ngate) |
 
 ## Quick Start
 

diff --git a/docs/source/malware_report.rst b/docs/source/malware_report.rst
@@ -2694,3 +2694,107 @@ The table below lists the APKs we tested.
 +-------+------------------------------------------------------------------+
 | 7     | BA622A4F0D30C433A1D36DDFF294759582067D5EAE438937DEF75987FAC67B33 |
 +-------+------------------------------------------------------------------+
+
+NGate Malware Family Analysis Report
+====================================
+
+A new Quark rule (#00277) was generated to detect NFC reader-mode preparation and added to Quark's rule pool. NGate is an Android NFC banking trojan first documented by ESET in 2024, targeting Slovak banking customers. It is documented to weaponize the open-source NFCGate research toolkit to relay contactless payment card data from the victim's phone to an attacker-controlled device, enabling unauthorized point-of-sale and ATM transactions. Check `here <https://github.com/quark-engine/quark-rules>`__ for the rule pool details.
+
+Quark's rule classification flagged **14 of 14 NGate samples** as high-risk in this experiment (detection rate **100%**). Benign-cohort false-positive rate was not measured here. Please check :ref:`here <list-of-tested-apks-ngate>` for the APKs we tested.
+
+Identified Well-Known Threats
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This section uses MITRE ATT&CK Mobile as its reference taxonomy. NGate has no dedicated MITRE software entry. The techniques below were observed in NGate samples through Quark's static bytecode analysis.
+
+.. list-table::
+   :header-rows: 1
+   :widths: 30 70
+
+   * - MITRE Technique
+     - Real-world manifestation in NGate
+   * - T1644 Out of Band Data
+     - Configuring the IsoDep NFC reader with a non-default transceive timeout — the canonical preparation step required before APDU exchange over the NFC out-of-band channel, used by NGate as part of its documented contactless-card relay chain
+   * - T1406 Obfuscated Files or Information
+     - Dynamic method invocation via Java reflection from many attacker-authored classes, hiding the malware's true control flow from static analysis tools
+   * - T1628.001 Suppress Application Icon
+     - Programmatically hiding the malicious app's launcher icon after installation to delay user detection and removal
+
+All cluster representatives below were extracted from sample ``98f2667aec5f74c0701467ea86c6a45a53604075f968263c12650759d157ba59.apk`` — chosen as the representative sample whose detected behaviors most fully cover the documented profile of NGate. The other 13 family samples were used to compute the detection-rate figure above.
+
+Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then walk through the call sequence and list the underlying rules.
+
+**1. T1644 Out of Band Data**
+
+`T1644 Out of Band Data — attack.mitre.org <https://attack.mitre.org/techniques/T1644>`__
+
+    **MITRE definition (T1644):** Adversaries may communicate with compromised devices using out of band data streams. This could be done for a variety of reasons, including evading network traffic monitoring, as a backup method of command and control, or for data exfiltration if the device is not connected to any Internet-providing networks. Several out of band data streams exist, such as SMS messages, NFC, and Bluetooth.
+
+``LK1/d;b`` (a ProGuard-renamed class operating on ``Landroid/nfc/Tag``, consistent with the NFCGate-derived reader-mode initialization that NGate is documented to repackage) calls ``IsoDep.get(Tag)`` to acquire an ``IsoDep`` handle for the contactless card and then ``IsoDep.setTimeout(int)`` on the same instance, with the IsoDep reference flowing directly between the two calls. Configuring a custom transceive timeout is uncharacteristic of legitimate payment apps (which use the platform default) and is the canonical setup step required before any subsequent APDU exchange over the NFC out-of-band channel.
+
+Behaviors detected by Quark:
+
+* Configure custom timeout for IsoDep card communication (NFC reader-mode preparation) (#00277)
+
+**2. T1406 Obfuscated Files or Information**
+
+`T1406 Obfuscated Files or Information — attack.mitre.org <https://attack.mitre.org/techniques/T1406>`__
+
+    **MITRE definition (T1406):** Adversaries may attempt to make a payload or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the device or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
+
+``LO/q;onPrepareActionMode`` is one of nine distinct attacker-namespace parents in this sample where the malware dynamically resolves a method by name and invokes it via reflection. Spreading reflective dispatch across many short ProGuard-renamed classes obfuscates the actual call targets from static disassembly tools that match on direct call edges, falling under T1406's broader "otherwise obfuscating its contents" clause for control-flow obfuscation.
+
+Behaviors detected by Quark:
+
+* Invoke method dynamically via reflection (#00276)
+
+**3. T1628.001 Suppress Application Icon**
+
+`T1628.001 Suppress Application Icon — attack.mitre.org <https://attack.mitre.org/techniques/T1628/001>`__
+
+    **MITRE definition (T1628.001):** A malicious application could suppress its icon from being displayed to the user in the application launcher. This hides the fact that it is installed, and can make it more difficult for the user to uninstall the application. Hiding the application's icon programmatically does not require any special permissions.
+
+``LZ/h;run`` (an attacker-authored Runnable executed from background context) toggles the launcher activity's ``ComponentEnabledSetting`` to ``COMPONENT_ENABLED_STATE_DISABLED``, hiding the app's icon from the device home screen. This delays user discovery of the installed app and makes uninstalling it harder.
+
+Behaviors detected by Quark:
+
+* Hide the current app's icon (#00079)
+
+.. _list-of-tested-apks-ngate:
+
+List of Tested APKs
+~~~~~~~~~~~~~~~~~~~
+
+The table below lists the APKs we tested.
+
++-------+------------------------------------------------------------------+
+| index | sha256                                                           |
++=======+==================================================================+
+| 1     | 0E2AEE7B6CF50249520F0F824EA52F7770E2D2A791F0E6D94C514B11ED482FA4 |
++-------+------------------------------------------------------------------+
+| 2     | 162F8C6BAFE0C343C37F173344C4F6880EAEC0AEA7B491565DB874366B161784 |
++-------+------------------------------------------------------------------+
+| 3     | 17A16F08108E25AF1C8B058ADBACA2CADA6A93C2D38C9854148F9E9CAAC76AC3 |
++-------+------------------------------------------------------------------+
+| 4     | 1D126E5904DDE3B46175A4AAE89EEC1FB8A6B80E35B1F473878E5DD288F8AAE6 |
++-------+------------------------------------------------------------------+
+| 5     | 31FDAA61CADD545C4C859ED255ADA413CBB09B2201F047745A7374EC1D54AA43 |
++-------+------------------------------------------------------------------+
+| 6     | 3CB4B373A24AFB10B8003762E763E6B44008BDF9A58D0A9A2B80A5DE68308ECD |
++-------+------------------------------------------------------------------+
+| 7     | 45BBA7681E5A2C3512E6337BAED739D3AF30AF5BFC9FFE0AE18E211E068274A1 |
++-------+------------------------------------------------------------------+
+| 8     | 54EAC45F3F5AC121C74C2EF66923CD3DA5A5DC8B03BF3E4C43935FCC1E5F6EED |
++-------+------------------------------------------------------------------+
+| 9     | 5CFE6EC669BE05D457D9B98CDD76901CC8913AE9F4E8B1A29D97770C6925A5C4 |
++-------+------------------------------------------------------------------+
+| 10    | 9220B2F18DD79BEF1D9B3739D42DA538BFBCC73CDA4F9B0028C2F425BE501FB1 |
++-------+------------------------------------------------------------------+
+| 11    | 95D906DCA5A3BE5CF066268662B3C953860E54E9CDCFCD427FAF0AAA9CB62BAD |
++-------+------------------------------------------------------------------+
+| 12    | 98F2667AEC5F74C0701467EA86C6A45A53604075F968263C12650759D157BA59 |
++-------+------------------------------------------------------------------+
+| 13    | C659454DD6ED62BC7A0C9E0455297E41BA57B0B7935A826150C1F8C0DB6F89D2 |
++-------+------------------------------------------------------------------+
+| 14    | E19A7C8E4994EA4ED680136C9E3A6FFF7B82C72F5743952821A446B6CB830F06 |
++-------+------------------------------------------------------------------+