94.140.114.22:41322

ip not resolving

Tracked by C2 Tracker · Whois queried never

Network

Network: —
CIDR: —
Country: —

Contact

Handle: —
Abuse: —

Observed in malware

Family	Sample SHA-256	First seen
Bitter	43e3a0b0d5e2…	2022-03-22

About Bitter

South-Asia-nexus APT (ETDA: T-APT-17, active since 2013) whose Android payload "Dracarys" ships inside repackaged legitimate apps (documented by Meta's Q2 2022 adversarial threat report). Dracarys components live under org.zcode.dracarys.* (services.WynkService, the accessibility service AlfredService, activities.XActivity) and abuse Accessibility Services for self-granting permissions. The C2 panel is the API_URL constant in org.zcode.dracarys.config.ApiConfig; every exfiltration channel posts to <API_URL>/v3/report/<channel> while tasking arrives over Firebase messaging. A shared ProSpy code lineage links the "Beyond Bitter" hack-for-hire campaign to this actor.

Meta: Quarterly Adversarial Threat Report, Q2 2022 (Dracarys / Bitter)ETDA APT groups encyclopedia: Bitter (T-APT-17)jacobsoo/ATG: Bitter (Dracarys analysis and sample table)

Signing certificate

Subject CN: tucsand
Issuer CN: tucsand
Valid: 2021-10-21 → 2046-10-15
Fingerprint: 87d898cbd0a0d42c8c3ca0ed44ff4228ea5e5342b1cc48f7cdb65e5b4626132f

Other samples signed with this certificate? That's a lead worth checking — but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.