Date: 10/29/2026
Severity: High
Summary
A rental Android spyware kit named uCreator hijacks Telegram and WeChat accounts by embedding malicious code into modified versions of the legitimate apps. It targets users who install tampered apps distributed outside official app stores or run WeChat inside the operators’ container application. The kit’s Telegram component is linked to Baohuo, a backdoor documented by Doctor Web in October 2025. Doctor Web previously identified Baohuo in modified Telegram X apps and estimated that more than 58,000 devices were infected. The campaign’s banners were localized in Portuguese for Brazil and Indonesian, suggesting a focus on these language-speaking audiences. However, Doctor Web’s 2025 infection data showed India with the highest share of infected devices at 22.8%, followed by Brazil at 20.5% and Indonesia at 9.6%.
Indicators of Compromise (IOC) List
Domains/URLs | hpncallback.gold5play.com hpncallback.qianxunlbs.com telegram-apk.uzyzx.com hw.android.videoflow.cn r-bp1jehsclgbuu48m7tpd.redis.rds.aliyuncs.com:65531 kfpt.oss-cn-hangzhou.aliyuncs.com/android/app/YingGai/ |
IP Address | 159.138.237.10 159.138.229.12 43.225.141.209 |
Hash | 2fc4bad71eda25b9022ea7cb090d6419911ecd67e50e746b418f8a617a980301
0142749a159be3e41d28f910eebf28b577a282880bd0c2383bd7404189f4ff94
dcec9640271a782553599197bcb85367971a5bb4aa84c3787d1e49a3f4f9420e
805834e6b8c12e180117a1816b48e387c33b53520f5a91cbf858441dc895e717
a90e3ab2b5cf306439a378faf7107a89196116ad7ee4ad5791c2ba8839ba21c4
f82ac2c525d1ed82e57b3f27ae689aeda46875a893ca4c42876b3166ba66bb20
99c5be579d218acfd2c7e2662528e7ad32a1a605d8efd1da732c13931bc30c4c
9c8b147f76312e651faabb1411a3270efca984dd8f33bd8ded3ea611c7c583a1
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "hpncallback.gold5play.com" or url like "hpncallback.gold5play.com" or siteurl like "hpncallback.gold5play.com" or domainname like "hpncallback.qianxunlbs.com" or url like "hpncallback.qianxunlbs.com" or siteurl like "hpncallback.qianxunlbs.com" or domainname like "hw.android.videoflow.cn" or url like "hw.android.videoflow.cn" or siteurl like "hw.android.videoflow.cn" or domainname like "telegram-apk.uzyzx.com" or url like "telegram-apk.uzyzx.com" or siteurl like "telegram-apk.uzyzx.com" or domainname like "r-bp1jehsclgbuu48m7tpd.redis.rds.aliyuncs.com:65531" or url like "r-bp1jehsclgbuu48m7tpd.redis.rds.aliyuncs.com:65531" or siteurl like "r-bp1jehsclgbuu48m7tpd.redis.rds.aliyuncs.com:65531" or domainname like "kfpt.oss-cn-hangzhou.aliyuncs.com/android/app/YingGai/" or url like "kfpt.oss-cn-hangzhou.aliyuncs.com/android/app/YingGai/" or siteurl like "kfpt.oss-cn-hangzhou.aliyuncs.com/android/app/YingGai/" |
Detection Query 2 : | dstipaddress IN ("43.225.141.209","159.138.237.10","159.138.229.12") or srcipaddress IN ("43.225.141.209","159.138.237.10","159.138.229.12") |
Detection Query 3 : | sha256hash IN ("a90e3ab2b5cf306439a378faf7107a89196116ad7ee4ad5791c2ba8839ba21c4","f82ac2c525d1ed82e57b3f27ae689aeda46875a893ca4c42876b3166ba66bb20","dcec9640271a782553599197bcb85367971a5bb4aa84c3787d1e49a3f4f9420e","2fc4bad71eda25b9022ea7cb090d6419911ecd67e50e746b418f8a617a980301","805834e6b8c12e180117a1816b48e387c33b53520f5a91cbf858441dc895e717","99c5be579d218acfd2c7e2662528e7ad32a1a605d8efd1da732c13931bc30c4c","0142749a159be3e41d28f910eebf28b577a282880bd0c2383bd7404189f4ff94","9c8b147f76312e651faabb1411a3270efca984dd8f33bd8ded3ea611c7c583a1")
|
Reference:
uCreator Android Spyware Targets Telegram and WeChat