6b4d271a48d118843aee3dee…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256: 6b4d271a48d118843aee3dee4481fa2930732ed7075db3241a8991418f00d92b
MD5: 671e6a53a25075b9ce3a6576ddaf5174

Observed

Families: MuddyWater
First seen: 2018-09-26

APK metadata

Summary

Type: Android · APK
Package: com.amazon.titan
Main activity: com.amazon.titan.client.Main
Internal version: 2
Displayed version: 1.1.1
Min SDK: 16
Target SDK: 22

Signing certificate

Valid from: 2018-09-25 09:55:19
Valid to: 2218-08-08 09:55:19
Serial: 791cdc
Thumbprint: f40f2c71ff31e2ce67b9ff9415626c0b2549767f
Subject: CN:alex jackson
Issuer: CN:alex jackson

Permissions (13)

android.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.GET_ACCOUNTSandroid.permission.INTERNETandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.SEND_SMSandroid.permission.WRITE_EXTERNAL_STORAGE

Activities (1)

com.amazon.titan.client.Main

Services (1)

com.amazon.titan.client.Client

Receivers (3)

com.amazon.titan.receiver.BootReceiver
com.amazon.titan.receiver.SmsReceiver
com.amazon.titan.receiver.WifiReceiver

Intent filters — actions

.Clientandroid.intent.action.BOOT_COMPLETEDandroid.net.conn.CONNECTIVITY_CHANGEandroid.net.wifi.WIFI_STATE_CHANGEDandroid.provider.Telephony.SMS_RECEIVED

Intent filters — categories

android.intent.category.HOME

C2 configuration (5)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
103.13.67.4	ip	4012	—	MuddyWater	2018-09-26
78.129.139.131	ip	4012	—	MuddyWater	2018-09-26
80.80.163.182	ip	4012	—	MuddyWater	2018-09-26
80.90.87.201	ip	4012	—	MuddyWater	2018-09-26
91.187.114.210	ip	4012	—	MuddyWater	2018-09-26

Signing certificate

Subject CN: alex jackson
Issuer CN: alex jackson
Fingerprint: 0c722d78138cdce2775defe619f21875888158f54279e82b13a650fe02ee4c41

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About MuddyWater

Android implant of the MuddyWater (Seedworm) actor. Four-part manifest fingerprint (INTERNET, client.Main activity, receiver.SmsReceiver, client.Client service); the C2 IP and port are static field init values of the /titan/appUtil/utils/AppField; config class (SERVER_IP / SERVER_PORT).

MITRE ATT&CK: MuddyWater (G0069)