C2Tracker

26de4265303491bed1424d85…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
26de4265303491bed1424d85b263481ac153c2b3513f9ee48ffb42c12312ac43
MD5
f2fd6a2c1d5a4c922ad3b00eaac4d755

Observed

Families
MuddyWater
First seen
2018-12-31

APK metadata

Summary

Type
Android · APK
Package
com.amazon.titan
Main activity
com.amazon.titan.client.Main
Internal version
5
Displayed version
1.2.1
Min SDK
16
Target SDK
22

Signing certificate

Valid from
2018-09-25 09:55:19
Valid to
2218-08-08 09:55:19
Serial
791cdc
Thumbprint
f40f2c71ff31e2ce67b9ff9415626c0b2549767f
Subject
CN:alex jackson
Issuer
CN:alex jackson

Permissions (15)

android.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.GET_ACCOUNTSandroid.permission.INTERNETandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.SEND_SMSandroid.permission.WRITE_EXTERNAL_STORAGE

Activities (1)

  • com.amazon.titan.client.Main

Services (2)

  • com.amazon.titan.client.Client
  • com.amazon.titan.receiver.GPSService

Receivers (3)

  • com.amazon.titan.receiver.BootReceiver
  • com.amazon.titan.receiver.SmsReceiver
  • com.amazon.titan.receiver.WifiReceiver

Intent filters — actions

.Clientandroid.intent.action.BOOT_COMPLETEDandroid.net.conn.CONNECTIVITY_CHANGEandroid.net.wifi.WIFI_STATE_CHANGEDandroid.provider.Telephony.SMS_RECEIVED

Intent filters — categories

android.intent.category.HOME

C2 configuration (5)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
103.13.67.4 ip 4012 — MuddyWater 2018-12-31
78.129.139.131 ip 4012 — MuddyWater 2018-12-31
80.80.163.182 ip 4012 — MuddyWater 2018-12-31
80.90.87.201 ip 4012 — MuddyWater 2018-12-31
91.187.114.210 ip 4012 — MuddyWater 2018-12-31

Signing certificate

Subject CN
alex jackson
Issuer CN
alex jackson
Fingerprint
0c722d78138cdce2775defe619f21875888158f54279e82b13a650fe02ee4c41

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About MuddyWater

Android implant of the MuddyWater (Seedworm) actor. Four-part manifest fingerprint (INTERNET, client.Main activity, receiver.SmsReceiver, client.Client service); the C2 IP and port are static field init values of the /titan/appUtil/utils/AppField; config class (SERVER_IP / SERVER_PORT).

MITRE ATT&CK: MuddyWater (G0069)