C2Tracker

9af8a93519d22ed04ffb9ccf…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256
9af8a93519d22ed04ffb9ccf6861c9df1b77dc5d22e0aeaff4a582dbf8660ba6
MD5
10ec3571596c30b9993b89f12d29d23c

Observed

Families
MuddyWater
First seen
2018-12-26

APK metadata

Summary

Type
Android · APK
Package
com.amazon.titan
Main activity
com.amazon.titan.client.Main
Internal version
3
Displayed version
1.1.1
Min SDK
16
Target SDK
22

Signing certificate

Valid from
2018-09-25 09:55:19
Valid to
2218-08-08 09:55:19
Serial
791cdc
Thumbprint
f40f2c71ff31e2ce67b9ff9415626c0b2549767f
Subject
CN:alex jackson
Issuer
CN:alex jackson

Permissions (13)

android.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.GET_ACCOUNTSandroid.permission.INTERNETandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.SEND_SMSandroid.permission.WRITE_EXTERNAL_STORAGE

Activities (1)

  • com.amazon.titan.client.Main

Services (1)

  • com.amazon.titan.client.Client

Receivers (3)

  • com.amazon.titan.receiver.BootReceiver
  • com.amazon.titan.receiver.SmsReceiver
  • com.amazon.titan.receiver.WifiReceiver

Intent filters — actions

.Clientandroid.intent.action.BOOT_COMPLETEDandroid.net.conn.CONNECTIVITY_CHANGEandroid.net.wifi.WIFI_STATE_CHANGEDandroid.provider.Telephony.SMS_RECEIVED

Intent filters — categories

android.intent.category.HOME

C2 configuration (5)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
103.13.67.4 ip 4012 — MuddyWater 2018-12-26
78.129.139.131 ip 4012 — MuddyWater 2018-12-26
80.80.163.182 ip 4012 — MuddyWater 2018-12-26
80.90.87.201 ip 4012 — MuddyWater 2018-12-26
91.187.114.210 ip 4012 — MuddyWater 2018-12-26

Signing certificate

Subject CN
alex jackson
Issuer CN
alex jackson
Fingerprint
0c722d78138cdce2775defe619f21875888158f54279e82b13a650fe02ee4c41

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About MuddyWater

Android implant of the MuddyWater (Seedworm) actor. Four-part manifest fingerprint (INTERNET, client.Main activity, receiver.SmsReceiver, client.Client service); the C2 IP and port are static field init values of the /titan/appUtil/utils/AppField; config class (SERVER_IP / SERVER_PORT).

MITRE ATT&CK: MuddyWater (G0069)