80.80.163.182:4012
ipTracked by C2 Tracker · Whois queried never
Network
- Network
- —
- CIDR
- —
- Country
- —
Contact
- Handle
- —
- Abuse
- —
Observed in malware
| Family | Sample SHA-256 | First seen |
|---|---|---|
| MuddyWater | 6b4d271a48d1… | 2018-09-26 |
| MuddyWater | 9af8a93519d2… | 2018-12-26 |
| MuddyWater | dff2e39b2e00… | 2018-12-31 |
| MuddyWater | 26de42653034… | 2018-12-31 |
| MuddyWater | 3bfec096c483… | 2019-01-02 |
Attributed to: MuddyWater
About MuddyWater
Android implant of the MuddyWater (Seedworm) actor. Four-part manifest fingerprint (INTERNET, client.Main activity, receiver.SmsReceiver, client.Client service); the C2 IP and port are static field init values of the /titan/appUtil/utils/AppField; config class (SERVER_IP / SERVER_PORT).
Signing certificate
- Subject CN
- Ben Sen
- Issuer CN
- Ben Sen
- Valid
- 2019-01-02 → 2073-10-05
- Fingerprint
- 0f1f9177d9c8dafd4a3ae639803af2cafa8b3d8ec5e87bddbfa0bc647d21b8cc
Other samples signed with this certificate? That's a lead worth checking — but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.