C2Tracker

3bfec096c4837d1e6485fe0a…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
3bfec096c4837d1e6485fe0ae0ea6f1c0b44edc611d4f2204cc9cf73c985cbc2
MD5
99e5deeb8182ec199936f9cf2e41b173

Observed

Families
MuddyWater
First seen
2019-01-02

APK metadata

Summary

Type
Android · APK
Package
com.amazon.titan
Main activity
com.amazon.titan.client.Main
Internal version
5
Displayed version
1.2.1
Min SDK
16
Target SDK
22

Signing certificate

Valid from
2019-01-02 15:46:49
Valid to
2073-10-05 15:46:49
Serial
5a770643
Thumbprint
a5bbaa95b2d581cb38e7c5ceea102ebf808f75cc
Subject
C:BS, CN:Ben Sen, L:BenSeno, O:BenSen, ST:BenoSeno, OU:Beno Seno
Issuer
C:BS, CN:Ben Sen, L:BenSeno, O:BenSen, ST:BenoSeno, OU:Beno Seno

Permissions (15)

android.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.GET_ACCOUNTSandroid.permission.INTERNETandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.SEND_SMSandroid.permission.WRITE_EXTERNAL_STORAGE

Activities (1)

  • com.amazon.titan.client.Main

Services (2)

  • com.amazon.titan.client.Client
  • com.amazon.titan.receiver.GPSService

Receivers (3)

  • com.amazon.titan.receiver.BootReceiver
  • com.amazon.titan.receiver.SmsReceiver
  • com.amazon.titan.receiver.WifiReceiver

Intent filters — actions

.Clientandroid.intent.action.BOOT_COMPLETEDandroid.net.conn.CONNECTIVITY_CHANGEandroid.net.wifi.WIFI_STATE_CHANGEDandroid.provider.Telephony.SMS_RECEIVED

Intent filters — categories

android.intent.category.HOME

C2 configuration (5)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
103.13.67.4 ip 4012 — MuddyWater 2019-01-02
78.129.139.131 ip 4012 — MuddyWater 2019-01-02
80.80.163.182 ip 4012 — MuddyWater 2019-01-02
80.90.87.201 ip 4012 — MuddyWater 2019-01-02
91.187.114.210 ip 4012 — MuddyWater 2019-01-02

Signing certificate

Subject CN
Ben Sen
Issuer CN
Ben Sen
Fingerprint
0f1f9177d9c8dafd4a3ae639803af2cafa8b3d8ec5e87bddbfa0bc647d21b8cc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About MuddyWater

Android implant of the MuddyWater (Seedworm) actor. Four-part manifest fingerprint (INTERNET, client.Main activity, receiver.SmsReceiver, client.Client service); the C2 IP and port are static field init values of the /titan/appUtil/utils/AppField; config class (SERVER_IP / SERVER_PORT).

MITRE ATT&CK: MuddyWater (G0069)