Analyzing an Illegal Android Gambling App Built with Flutter

    Tuesday, November 10, 2026 In: Threat Research Print

    Date: 11/10/2026

    Severity: Medium

    Summary

    Cybercriminals are increasingly using Flutter to develop Android malware because its cross-platform capabilities and complex architecture make reverse engineering difficult. Researchers analyzed a recently discovered Android malware named TinstaPorn, which disguises itself as an online casino platform impersonating a popular Macau casino. The app offers rigged gambling games, VIP recharge schemes, and referral rewards to exploit users financially. In addition to gambling fraud, it steals sensitive information, including victims' phone numbers and geolocation data. The case highlights how legitimate development frameworks like Flutter can be abused to build sophisticated mobile malware and evade security analysis. 

    Indicators of Compromise (IOC) List

    Domains/URLs

    https://gitee.com/lspxgit/nocode/raw/master/address.txt

    https://github.com/googleaidog/nocode/blob/master/address.txt

    https://zc.nationbj.com]/device/register

    https://reg.gitshreg611.xyz/device/register

    https://gitee.com/lspxgit/yongli/raw/main/helpline.txt

    https://raw.githubusercontent.com/kaerkaerkaerzzz/yongli/main/helpline.txt

    https://www.game250522linecfg.xyz

    https://www.ylhg250627linecfg.xyz

    https://www.tt250627linecfg.xyz

    https://line.yongli250627linecfg.xyz

    https://api.cloudfareproxy2618.xyz

    https://api.testylhg24.online

    https://up.logupload0628.xyz/app/log/raw/report

    https://reg.alibabareg0303.com

    https://reg.baidureg0627.xyz

    https://reg.baidureg0621.xyz

    https://hsreg.youkureg510.xyz

    https://reg.gptreg0706.xyz

    Hash

    d9020e64482821585245bf29fc96a046395b33d8e1830e17eeb949a2eb16a4d0

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "https://reg.gitshreg611.xyz/device/register" or url like "https://reg.gitshreg611.xyz/device/register" or siteurl like "https://reg.gitshreg611.xyz/device/register" or domainname like "https://www.game250522linecfg.xyz" or url like "https://www.game250522linecfg.xyz" or siteurl like "https://www.game250522linecfg.xyz" or domainname like "https://www.tt250627linecfg.xyz" or url like "https://www.tt250627linecfg.xyz" or siteurl like "https://www.tt250627linecfg.xyz" or domainname like "https://api.cloudfareproxy2618.xyz" or url like "https://api.cloudfareproxy2618.xyz" or siteurl like "https://api.cloudfareproxy2618.xyz" or domainname like "https://line.yongli250627linecfg.xyz" or url like "https://line.yongli250627linecfg.xyz" or siteurl like "https://line.yongli250627linecfg.xyz" or domainname like "https://reg.baidureg0627.xyz" or url like "https://reg.baidureg0627.xyz" or siteurl like "https://reg.baidureg0627.xyz" or domainname like "https://gitee.com/lspxgit/yongli/raw/main/helpline.txt" or url like "https://gitee.com/lspxgit/yongli/raw/main/helpline.txt" or siteurl like "https://gitee.com/lspxgit/yongli/raw/main/helpline.txt" or domainname like "https://reg.gptreg0706.xyz" or url like "https://reg.gptreg0706.xyz" or siteurl like "https://reg.gptreg0706.xyz" or domainname like "https://raw.githubusercontent.com/kaerkaerkaerzzz/yongli/main/helpline.txt" or url like "https://raw.githubusercontent.com/kaerkaerkaerzzz/yongli/main/helpline.txt" or siteurl like "https://raw.githubusercontent.com/kaerkaerkaerzzz/yongli/main/helpline.txt" or domainname like "https://api.testylhg24.online" or url like "https://api.testylhg24.online" or siteurl like "https://api.testylhg24.online" or domainname like "https://hsreg.youkureg510.xyz" or url like "https://hsreg.youkureg510.xyz" or siteurl like "https://hsreg.youkureg510.xyz" or domainname like "https://up.logupload0628.xyz/app/log/raw/report" or url like "https://up.logupload0628.xyz/app/log/raw/report" or siteurl like "https://up.logupload0628.xyz/app/log/raw/report" or domainname like "https://reg.alibabareg0303.com" or url like "https://reg.alibabareg0303.com" or siteurl like "https://reg.alibabareg0303.com" or domainname like "https://www.ylhg250627linecfg.xyz" or url like "https://www.ylhg250627linecfg.xyz" or siteurl like "https://www.ylhg250627linecfg.xyz" or domainname like "https://reg.baidureg0621.xyz" or url like "https://reg.baidureg0621.xyz" or siteurl like "https://reg.baidureg0621.xyz" or domainname like "https://github.com/googleaidog/nocode/blob/master/address.txt" or url like "https://github.com/googleaidog/nocode/blob/master/address.txt" or siteurl like "https://github.com/googleaidog/nocode/blob/master/address.txt" or domainname like "https://gitee.com/lspxgit/nocode/raw/master/address.txt" or url like "https://gitee.com/lspxgit/nocode/raw/master/address.txt" or siteurl like "https://gitee.com/lspxgit/nocode/raw/master/address.txt" or domainname like "https://zc.nationbj.com]/device/register" or siteurl like "https://zc.nationbj.com]/device/register" or url like "https://zc.nationbj.com]/device/register"

    Detection Query 2 :

    sha256hash in ("d9020e64482821585245bf29fc96a046395b33d8e1830e17eeb949a2eb16a4d0")

    Reference:    

    https://www.fortinet.com/blog/threat-research/analyzing-an-illegal-android-gambling-app-built-with-flutter  


    Tags

    MalwareAndroid MalwareGamblingData Stealer

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.