hxxps://m[.]facebook[.]com/recover/initiate/?privacy_mutation_token=eyJ0eXBlIjowLCJjcmVhdGlvbl90aW1lIjoxNzEzMjk1NTkxLCJjYWxsc2l0ZV9pZCI6Mjg0Nzg1MTQ5MzQ1MzY5fQ%3D%3D&c=https%3A%2F%2Fm[.]facebook[.]com%2Flogin[.]php%3Fskip_api_login%3D1%26api_key%3D597615686992125%26kid_directed_site%3D0%26app_id%3D597615686992125%26signed_next%3D1%26next%3Dhttps%253A%252F%252Fm[.]facebook[.]com%252Fv13[.]0%252Fdialog%252Foauth%253Fcct_prefetching%253D0%2526client_id%253D597615686992125%2526cbt%253D1713295570581%2526e2e%253D%25257B%252522init%252522%25253A1713295570581%25257D%2526ies%253D0%2526sdk%253Dandroid-13[.]1[.]0%2526sso%253Dchrome_custom_tab%2526nonce%253D05a7f2f1-897b-4871-8869-ff69a682c61b%2526scope%253Demail%25252C%252Buser_friends%25252Copenid%2526state%253D%25257B%2525220_auth_logger_id%252522%25253A%25252291cbaeeb-b46d-4b4b-870c-aab017d0de6f%252522%25252C%2525223_method%252522%25253A%252522custom_tab%252522%25252C%2525227_challenge%252522%25253A%252522qc53a5r73got6k5cr60j%252522%25257D%2526code_challenge_method%253DS256%2526default_audience%253Dfriends%2526login_behavior%253DNATIVE_WITH_FALLBACK%2526redirect_uri%253Dfbconnect%25253A%25252F%25252Fcct[.]com[.]zhiliaoapp[.]musically%2526auth_type%253Drerequest%2526response_type%253Did_token%25252Ctoken%25252Csigned_request%25252Cgraph_domain%2526return_scopes%253Dtrue%2526code_challenge%253DQSMYeLrmQ6ILYM2M0NEjNNL1lK0AnrLSGzNjdXuaRiY%2526ret%253Dlogin%2526fbapp_pres%253D0%2526logger_id%253D91cbaeeb-b46d-4b4b-870c-aab017d0de6f%2526tp%253Dunspecified%26cancel_url%3Dfbconnect%253A%252F%252Fcct[.]com[.]zhiliaoapp[.]musically%253Ferror%253Daccess_denied%2526error_code%253D200%2526error_description%253DPermissions%252Berror%2526error_reason%253Duser_denied%2526state%253D%25257B%2525220_auth_logger_id%252522%25253A%25252291cbaeeb-b46d-4b4b-870c-aab017d0de6f%252522%25252C%2525223_method%252522%25253A%252522custom_tab%252522%25252C%2525227_challenge%252522%25253A%252522qc53a5r73got6k5cr60j%252522%25257D%26display%3Dtouch%26locale%3Dpl_PL%26pl_dbl%3D0%26refsrc%3Ddeprecated&r&cuid&ars=facebook_login&lwv=100&locale2=pl_PL&refid=9

Sharing

Behavioral task

behavioral1

Sample

https://m.facebook.com/recover/initiate/?privacy_mutation_token=eyJ0eXBlIjowLCJjcmVhdGlvbl90aW1lIjoxNzEzMjk1NTkxLCJjYWxsc2l0ZV9pZCI6Mjg0Nzg1MTQ5MzQ1MzY5fQ%3D%3D&c=https%3A%2F%2Fm.facebook.com%2Flogin.php%3Fskip_api_login%3D1%26api_key%3D597615686992125%26kid_directed_site%3D0%26app_id%3D597615686992125%26signed_next%3D1%26next%3Dhttps%253A%252F%252Fm.facebook.com%252Fv13.0%252Fdialog%252Foauth%253Fcct_prefetching%253D0%2526client_id%253D597615686992125%2526cbt%253D1713295570581%2526e2e%253D%25257B%252522init%252522%25253A1713295570581%25257D%2526ies%253D0%2526sdk%253Dandroid-13.1.0%2526sso%253Dchrome_custom_tab%2526nonce%253D05a7f2f1-897b-4871-8869-ff69a682c61b%2526scope%253Demail%25252C%252Buser_friends%25252Copenid%2526state%253D%25257B%2525220_auth_logger_id%252522%25253A%25252291cbaeeb-b46d-4b4b-870c-aab017d0de6f%252522%25252C%2525223_method%252522%25253A%252522custom_tab%252522%25252C%2525227_challenge%252522%25253A%252522qc53a5r73got6k5cr60j%252522%25257D%2526code_challenge_method%253DS256%2526default_audience%253Dfriends%2526login_behavior%253DNATIVE_WITH_FALLBACK%2526redirect_uri%253Dfbconnect%25253A%25252F%25252Fcct.com.zhiliaoapp.musically%2526auth_type%253Drerequest%2526response_type%253Did_token%25252Ctoken%25252Csigned_request%25252Cgraph_domain%2526return_scopes%253Dtrue%2526code_challenge%253DQSMYeLrmQ6ILYM2M0NEjNNL1lK0AnrLSGzNjdXuaRiY%2526ret%253Dlogin%2526fbapp_pres%253D0%2526logger_id%253D91cbaeeb-b46d-4b4b-870c-aab017d0de6f%2526tp%253Dunspecified%26cancel_url%3Dfbconnect%253A%252F%252Fcct.com.zhiliaoapp.musically%253Ferror%253Daccess_denied%2526error_code%253D200%2526error_description%253DPermissions%252Berror%2526error_reason%253Duser_denied%2526state%253D%25257B%2525220_auth_logger_id%252522%25253A%25252291cbaeeb-b46d-4b4b-870c-aab017d0de6f%252522%25252C%2525223_method%252522%25253A%252522custom_tab%252522%25252C%2525227_challenge%252522%25253A%252522qc53a5r73got6k5cr60j%252522%25257D%26display%3Dtouch%26locale%3Dpl_PL%26pl_dbl%3D0%26refsrc%3Ddeprecated&r&cuid&ars=facebook_login&lwv=100&locale2=pl_PL&refid=9

Resource

android-x64-arm64-20240221-en

discovery evasion

android-11-x64

2 signatures

30 seconds

General

Target

https://m.facebook.com/recover/initiate/?privacy_mutation_token=eyJ0eXBlIjowLCJjcmVhdGlvbl90aW1lIjoxNzEzMjk1NTkxLCJjYWxsc2l0ZV9pZCI6Mjg0Nzg1MTQ5MzQ1MzY5fQ%3D%3D&c=https%3A%2F%2Fm.facebook.com%2Flogin.php%3Fskip_api_login%3D1%26api_key%3D597615686992125%26kid_directed_site%3D0%26app_id%3D597615686992125%26signed_next%3D1%26next%3Dhttps%253A%252F%252Fm.facebook.com%252Fv13.0%252Fdialog%252Foauth%253Fcct_prefetching%253D0%2526client_id%253D597615686992125%2526cbt%253D1713295570581%2526e2e%253D%25257B%252522init%252522%25253A1713295570581%25257D%2526ies%253D0%2526sdk%253Dandroid-13.1.0%2526sso%253Dchrome_custom_tab%2526nonce%253D05a7f2f1-897b-4871-8869-ff69a682c61b%2526scope%253Demail%25252C%252Buser_friends%25252Copenid%2526state%253D%25257B%2525220_auth_logger_id%252522%25253A%25252291cbaeeb-b46d-4b4b-870c-aab017d0de6f%252522%25252C%2525223_method%252522%25253A%252522custom_tab%252522%25252C%2525227_challenge%252522%25253A%252522qc53a5r73got6k5cr60j%252522%25257D%2526code_challenge_method%253DS256%2526default_audience%253Dfriends%2526login_behavior%253DNATIVE_WITH_FALLBACK%2526redirect_uri%253Dfbconnect%25253A%25252F%25252Fcct.com.zhiliaoapp.musically%2526auth_type%253Drerequest%2526response_type%253Did_token%25252Ctoken%25252Csigned_request%25252Cgraph_domain%2526return_scopes%253Dtrue%2526code_challenge%253DQSMYeLrmQ6ILYM2M0NEjNNL1lK0AnrLSGzNjdXuaRiY%2526ret%253Dlogin%2526fbapp_pres%253D0%2526logger_id%253D91cbaeeb-b46d-4b4b-870c-aab017d0de6f%2526tp%253Dunspecified%26cancel_url%3Dfbconnect%253A%252F%252Fcct.com.zhiliaoapp.musically%253Ferror%253Daccess_denied%2526error_code%253D200%2526error_description%253DPermissions%252Berror%2526error_reason%253Duser_denied%2526state%253D%25257B%2525220_auth_logger_id%252522%25253A%25252291cbaeeb-b46d-4b4b-870c-aab017d0de6f%252522%25252C%2525223_method%252522%25253A%252522custom_tab%252522%25252C%2525227_challenge%252522%25253A%252522qc53a5r73got6k5cr60j%252522%25257D%26display%3Dtouch%26locale%3Dpl_PL%26pl_dbl%3D0%26refsrc%3Ddeprecated&r&cuid&ars=facebook_login&lwv=100&locale2=pl_PL&refid=9

Sharing

General

Malware Config

Signatures

Files