Facebook/orca APK File Replicating Itself In My Downloads Folder

Maybe your like

Sign In
Create Account

Search Advanced

View New Content
Forum Rules
BleepingComputer.com
Forums
Members
Tutorials
Startup List
Virus Removal
Downloads
Uninstall List
Welcome Guide
More

Javascript Disabled DetectedYou currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Register a free account to unlock additional features at BleepingComputer.com Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site. Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Latest News: CISA flags VMware Aria Operations RCE flaw as exploited in attacks

Featured Deal: Build real cybersecurity skills for just $15 with this masterclass

Latest Buyer's Guide: Best VPNs in 2025

facebook/orca APK file replicating itself in my downloads folder Started by Boarenstein , May 28 2020 09:19 PM

This topic is locked

4 replies to this topic

#1 Boarenstein

Members
9 posts
OFFLINE

Gender:Male
Local time:05:46 PM

Posted 28 May 2020 - 09:19 PM

Hello,

I have been having trouble connecting to my apartment wifi this past few months. All of my devices are having a similar issue. It happens everytime my neighbors are playing their video games. The router is in my nextdoor neighbor's room. Naturally, I suspected them, since I can hear them talk about my browsing habits sometimes. The walls are really thin. That's why I started using VPN. I usually just ask him to restart the router and it would suddenly work, although i can see the router wasnt really restarted.

Last week, I had the same problem again, I could not connect to the wifi using my laptop. I asked him to restart it but it still wont work. I tried connecting to my mobile hotspot, and I had the same problem. I reset my network settings and it worked. I ran windows defender quick scan and offline scan as well as malwarebytes, but they did not find anything. I ran adwcleaner and it found something. I removed everything it can find. After this, I can hear my nextdoor neighbors talk outside of my room that I was scanning my laptop.

The next day while I was busy working from home, I saw an apk file replicating itself in my downloads folder in my phone. My phone was connected to my laptop. i was tethering my mobile data via USB to my laptop. I couldn't use the WIFI reliably anymore ( though I'm paying for it, as its part of the rent).

The file name was temp_486-1.apk, then it replicated into temp_486-2, and then temp_486-3. The date was 05/26/2020. This was two days after a phone update. I am using samsung a7. Then I found another file temp_486.apk dated 4/16/2020. I realized this was the first one. And they sent me a new one maybe because the update made it useless. I opened this apks using android studio and it says that it is facebook/orca. The file thumbnail of the apk is that of fb messenger. I noticed a lot of messenger updates lately. When messenger prompts for updates, I receive a warning not to install updates.

I am really getting worried and paranoid. And I really need your help. I performed a factory reset on my phone, but I kind of feel that whoever is doing this can still access my devices.

The file size is too large to attach here. Here is the google drive link:

temp_486.apk

https://drive.google.com/open?id=1_ojFgWEEI33VWqIQCmhWuX8Tj9CkIWt8

temp_486-1.apk

https://drive.google.com/open?id=1s4sTbaaRvFpHWPgsCqq5Hwz9dACyjXqf

Thanks in advance.

BC AdBot (Login to Remove)

BleepingComputer.com
Register to remove ads

#2 Boarenstein

Topic Starter
Members
9 posts
OFFLINE

Gender:Male
Local time:05:46 PM

Posted 28 May 2020 - 09:25 PM

I have been applying to an engineering position at a nearby company using my laptop. Right after I performed the factory reset, I received a sketchy sms message about a "Leadership position at the <insert address> office our company". I think they're baiting me and then send me a malicious link or file so they can control my device. They did not even put in the effort to state which company it is and which position it is. To be safe, I replied politely and mentioned i am interested in the position. But I then asked them if it is possible to move the conversation to the company's career website or by email. No replies so far.

#3 nasdaq

Malware Response Team
48,329 posts
OFFLINE

Gender:Male
Location:Montreal, QC. Canada
Local time:08:46 PM

Posted 31 May 2020 - 09:33 AM

Hello, Welcome to BleepingComputer. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === What Is an APK File? https://www.lifewire.com/apk-file-4152929 === Download the Farbar Recovery Scan Tool (FRST). Choose the 32 or 64 bit version for your system. and save it to a folder on your computer's Desktop. Double-click to run it. When the tool opens click Yes to disclaimer. Press Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. How to attach a file to your reply: In the Reply section in the bottom of the topic Click the "more reply Options" button.

Attach the file(s). A 2 Steps process. Select the "Choose a File" navigate to the location of the File. Click the file you wish to Attach. <- Step 1. Click Attach this file. <- Step 2. Click the Add reply button. Please post the logs for my review. Let me know what problems persists. Wait for further instructions p.s. This program is updated often. If it's identified as suspicious by your Anti-Virus program trust it if Downloaded from the link I provided. You should restore the program from the Quarantine folder. ==== p.s. Let me know if your Default Browser is Synced to other devices.

#4 Boarenstein

Topic Starter
Members
9 posts
OFFLINE

Gender:Male
Local time:05:46 PM

Posted 01 June 2020 - 12:52 PM

Hi, i have done the scan on my windows laptop in another thread. this particular problem is about an apk file in my android phone. after opening the apk, I found that it is a facebook apk app, but it was replicating in my downloads folder in my phone