URL:

https://telegram.org/dl/android/apk

Full analysis: https://app.any.run/tasks/c4046d82-7a55-4e68-9694-807e5903dab0
Verdict: Malicious activity
Analysis date: July 25, 2025, 13:24:41
OS: Android 14
Indicators:
MD5:

65CB27C08EE2CFD9380DDFF24BFE8027

SHA1:

E0CFED86D0B893A62303A0F6943B6B9A216B885F

SHA256:

7ADBD94101E2D5BA043214B744C24E9E32D2CE85BC0BE8DF2BB2BB10DB3600D3

SSDEEP:

3:N8IvUHBsn:2IsHBsn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Checks whether the screen is currently on

      • app_process64 (PID: 2557)

    • Executes system commands or scripts

      • app_process64 (PID: 2557)

  • SUSPICIOUS

    • Gets data of saved accounts

      • app_process64 (PID: 2557)

    • Accesses system-level resources

      • app_process64 (PID: 2557)

    • Scans for popular installed apps

      • app_process64 (PID: 2557)

    • Accesses external device storage files

      • app_process64 (PID: 2557)

    • Creates a WakeLock to manage power state

      • app_process64 (PID: 2557)

    • Detects when screen powers off

      • app_process64 (PID: 2557)

    • Detects presence of QEMU emulator

      • app_process64 (PID: 2557)

    • Updates data in the storage of application settings (SharedPreferences)

      • app_process64 (PID: 2557)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • app_process64 (PID: 2557)
      • app_process64 (PID: 2200)

    • Retrieves installed applications on device

      • app_process64 (PID: 2557)

    • Reads device bootloader configuration

      • app_process64 (PID: 2557)

  • INFO

    • Retrieves data from storage of application settings (SharedPreferences)

      • app_process64 (PID: 2557)

    • Loads a native library into the application

      • app_process64 (PID: 2557)

    • Dynamically inspects or modifies classes, methods, and fields at runtime

      • app_process64 (PID: 2557)

    • Creates and writes local files

      • app_process64 (PID: 2557)

    • Returns elapsed time since boot

      • app_process64 (PID: 2557)

    • Gets the display metrics associated with the device's screen

      • app_process64 (PID: 2557)

    • Dynamically registers broadcast event listeners

      • app_process64 (PID: 2557)

    • Verifies whether the device is connected to the internet

      • app_process64 (PID: 2557)

    • Dynamically loads a class in Java

      • app_process64 (PID: 2557)

    • Retrieves CPU core information

      • app_process64 (PID: 2557)

    • Verifies presence of SIM card

      • app_process64 (PID: 2557)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
11
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start app_process64 app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs app_process64 no specs artd no specs dex2oat32 no specs app_process64 app_process64 no specs

Process information

PID
CMD
Path
Indicators
Parent process
2200zygote64 /system/bin/app_process64
app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2233com.android.settings /system/bin/app_process64—app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2284org.chromium.chrome_zygote /system/bin/app_process64—app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2301org.chromium.chrome_zygote /system/bin/app_process64—app_process64
User:
u0_a72
Integrity Level:
UNKNOWN
Exit code:
0
2336org.chromium.chrome:privileged_process0 /system/bin/app_process64—app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2357com.android.adservices.api /system/bin/app_process64—app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2417org.chromium.chrome_zygote /system/bin/app_process64—app_process64
User:
u0_a72
Integrity Level:
UNKNOWN
Exit code:
0
2540/apex/com.android.art/bin/artd/apex/com.android.art/bin/artd—init
User:
artd
Integrity Level:
UNKNOWN
Exit code:
0
2543/apex/com.android.art/bin/dex2oat32 --zip-fd=6 --zip-location=/data/app/~~ljJFdfEmFELV8CQ76JvFRg==/org.telegram.messenger.web-NIXBbBz-qgytNuzpVWbKng==/base.apk --oat-fd=7 --oat-location=/data/app/~~ljJFdfEmFELV8CQ76JvFRg==/org.telegram.messenger.web-NIXBbBz-qgytNuzpVWbKng==/oat/arm64/base.odex --output-vdex-fd=8 --swap-fd=9 --class-loader-context-fds=10 --class-loader-context=PCL[]{PCL[/system/framework/org.apache.http.legacy.jar]} --classpath-dir=/data/app/~~ljJFdfEmFELV8CQ76JvFRg==/org.telegram.messenger.web-NIXBbBz-qgytNuzpVWbKng== --instruction-set=arm64 --instruction-set-features=default --instruction-set-variant=cortex-a53 --compiler-filter=verify --compilation-reason=install --compact-dex-level=none --max-image-block-size=524288 --resolve-startup-const-strings=true --generate-mini-debug-info --runtime-arg -Xtarget-sdk-version:34 --runtime-arg -Xhidden-api-policy:enabled --runtime-arg -Xms64m --runtime-arg -Xmx512m --comments=app-version-name:11.13.3,app-version-code:60819,art-version:340090000/apex/com.android.art/bin/dex2oat32—artd
User:
artd
Integrity Level:
UNKNOWN
Exit code:
0
2557<pre-initialized> /system/bin/app_process64
app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
58
Text files
28
Unknown types
16

Dropped files

PID
Process
Filename
Type
2557app_process64/data/data/org.telegram.messenger.web/files/cache4.db-journalbinary
MD5:—
SHA256:—
2557app_process64/storage/emulated/0/Android/data/org.telegram.messenger.web/cache/000000000_999999_temp.fgmc
MD5:—
SHA256:—
2557app_process64/storage/emulated/0/Android/data/org.telegram.messenger.web/files/Telegram/Telegram Images/000000000_999999.fgmc
MD5:—
SHA256:—
2557app_process64/storage/emulated/0/Android/data/org.telegram.messenger.web/files/Telegram/Telegram Video/000000000_999999.fgmc
MD5:—
SHA256:—
2557app_process64/data/data/org.telegram.messenger.web/files/tgnet.datbinary
MD5:—
SHA256:—
2557app_process64/storage/emulated/0/Android/data/org.telegram.messenger.web/files/Telegram/Telegram Audio/000000000_999999.fgmc
MD5:—
SHA256:—
2557app_process64/storage/emulated/0/Android/data/org.telegram.messenger.web/files/Telegram/Telegram Documents/000000000_999999.fgmc
MD5:—
SHA256:—
2557app_process64/data/data/org.telegram.messenger.web/files/account1/cache4.db-journalbinary
MD5:—
SHA256:—
2621app_process64/data/data/org.telegram.messenger.web/databases/com.google.android.datatransport.eventssqlite
MD5:—
SHA256:—
2621app_process64/data/data/org.telegram.messenger.web/files/cache4.dbsqlite
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
17
DNS requests
17
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
865
app_process64
GET
204
142.250.186.163:80
http://connectivitycheck.gstatic.com/generate_204
US
—
—
whitelisted
2200
app_process64
GET
200
172.217.16.206:80
http://clients2.google.com/time/1/current?cup2key=9:NNKpFdp0tTYRcQv7tBM5WxyuPinPdOQCVHBX20OgFrw&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
US
text
106 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
445
mdnsd
224.0.0.251:5353
—
—
—
unknown
574
app_process64
216.239.35.8:123
time.android.com
—
—
whitelisted
865
app_process64
172.217.18.4:443
www.google.com
GOOGLE
US
whitelisted
865
app_process64
142.250.186.163:80
connectivitycheck.gstatic.com
GOOGLE
US
whitelisted
1760
app_process64
108.177.15.81:443
staging-remoteprovisioning.sandbox.googleapis.com
GOOGLE
US
whitelisted
2200
app_process64
172.217.16.206:80
clients2.google.com
GOOGLE
US
whitelisted
2200
app_process64
149.154.167.99:443
telegram.org
Telegram Messenger Inc
GB
whitelisted
2200
app_process64
172.217.18.4:443
www.google.com
GOOGLE
US
whitelisted
2200
app_process64
74.125.133.84:443
accounts.google.com
GOOGLE
US
whitelisted
2200
app_process64
34.111.35.152:443
cdn4.cdn-telegram.org
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
connectivitycheck.gstatic.com
  • 142.250.186.163
whitelisted
www.google.com
  • 172.217.18.4
whitelisted
google.com
  • 142.250.181.238
whitelisted
time.android.com
  • 216.239.35.8
  • 216.239.35.0
  • 216.239.35.12
  • 216.239.35.4
whitelisted
staging-remoteprovisioning.sandbox.googleapis.com
  • 108.177.15.81
whitelisted
clients2.google.com
  • 172.217.16.206
whitelisted
telegram.org
  • 149.154.167.99
whitelisted
accounts.google.com
  • 74.125.133.84
whitelisted
cdn4.cdn-telegram.org
  • 34.111.35.152
unknown
androidchromeprotect.pa.googleapis.com
  • 172.217.16.202
whitelisted

Threats

PID
Process
Class
Message
865
app_process64
Misc activity
ET INFO Android Device Connectivity Check
2200
app_process64
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2200
app_process64
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2200
app_process64
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2200
app_process64
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2200
app_process64
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2200
app_process64
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2200
app_process64
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2200
app_process64
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://telegram.org/dl/android/apk