TinstaPorn Flutter Gambling Malware: OTX Pulse Analysis — Enterprise Detection Pack

---
title: TinstaPorn Gambling Malware C2 Domain Resolution
id: 7a3f1c2e-9b4d-4e6a-8c1f-2d5e7a9b0c11
status: experimental
description: Detects DNS resolution or network connection to known TinstaPorn Flutter gambling malware configuration, registration, and game server infrastructure identified in OTX pulse (2026-11-10).
author: Security Arsenal Threat Intelligence
references:
  - https://www.fortinet.com/blog/threat-research/analyzing-an-illegal-android-gambling-app-built-with-flutter
  - https://otx.alienvault.com
date: 2026/11/10
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.exfiltration
  - attack.t1041
logsource:
  category: dns
  product: windows
detection:
  selection_domain:
    query|contains:
      - 'nationbj.com'
      - 'cloudfareproxy2618.xyz'
      - 'testylhg24.online'
      - 'youkureg510.xyz'
      - 'yongli250627linecfg.xyz'
  condition: selection_domain
falsepositives:
  - Threat intelligence validation lookups by security analysts
level: high
---
title: TinstaPorn Malware Sample Hash Execution or Download
id: 8b4e2d3f-0c5e-5f7b-9d2a-3e6f8b0c1d22
status: experimental
description: Detects creation or execution of files matching known TinstaPorn Flutter gambling malware APK hashes from OTX pulse (2026-11-10).
author: Security Arsenal Threat Intelligence
references:
  - https://www.fortinet.com/blog/threat-research/analyzing-an-illegal-android-gambling-app-built-with-flutter
date: 2026/11/10
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1105
logsource:
  category: file_event
  product: windows
detection:
  selection_sha256:
    Hashes|contains:
      - 'd9020e64482821585245bf29fc96a046395b33d8e1830e17eeb949a2eb16a4d0'
  selection_md5:
    Hashes|contains:
      - '70766c883b45404adb65a8f4580dc00f'
  selection_sha1:
    Hashes|contains:
      - '283cc2f06267ecf2ce70135604ab2ce8deaee9dc'
  selection_name:
    TargetFilename|endswith: '.apk'
  condition: (selection_sha256 or selection_md5 or selection_sha1) and selection_name
falsepositives:
  - Malware research sandbox detonation
level: critical
---
title: Suspicious APK Sideload Download via Browser or Messaging Client
id: 9c5f3e4a-1d6f-6a8c-0e3b-4f7a9c1d2e33
status: experimental
description: Detects download of Android APK files by desktop browsers or messaging clients, consistent with TinstaPorn distribution via direct-download casino lure links. Tighten with proxy/EDR URL telemetry for the listed C2 domains.
author: Security Arsenal Threat Intelligence
references:
  - https://www.fortinet.com/blog/threat-research/analyzing-an-illegal-android-gambling-app-built-with-flutter
date: 2026/11/10
tags:
  - attack.initial_access
  - attack.t1189
  - attack.t1204.002
logsource:
  category: file_event
  product: windows
detection:
  selection_file:
    TargetFilename|endswith: '.apk'
  selection_process:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\Telegram.exe'
      - '\WhatsApp.exe'
      - '\WeChat.exe'
  condition: selection_file and selection_process
falsepositives:
  - Legitimate mobile application development or QA teams downloading APK builds
level: medium

// TinstaPorn Flutter Gambling Malware — Infrastructure & Download Hunt
// OTX Pulse 2026-11-10 | Hunt window: 30 days retroactive
let C2Domains = dynamic(["zc.nationbj.com", "api.cloudfareproxy2618.xyz", "api.testylhg24.online", "hsreg.youkureg510.xyz", "line.yongli250627linecfg.xyz"]);
let NetHits = DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteUrl has_any (C2Domains)
    | project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine
    | extend HuntType = "C2 Connection";
let DnsHits = DeviceEvents
    | where TimeGenerated > ago(30d)
    | where ActionType == "DnsQueryResponse" or AdditionalFields has_any (C2Domains)
    | extend QueriedDomain = tostring(parse_json(AdditionalFields).DnsQueryString)
    | where QueriedDomain has_any (C2Domains)
    | project TimeGenerated, DeviceName, QueriedDomain, InitiatingProcessFileName
    | extend HuntType = "DNS Resolution";
let ApkDownloads = DeviceFileEvents
    | where TimeGenerated > ago(30d)
    | where FileName endswith ".apk"
    | where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "telegram.exe", "whatsapp.exe", "wechat.exe")
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
    | extend HuntType = "APK Sideload Download";
let HashMatch = DeviceFileEvents
    | where TimeGenerated > ago(30d)
    | where SHA256 == "d9020e64482821585245bf29fc96a046395b33d8e1830e17eeb949a2eb16a4d0"
       or MD5 == "70766c883b45404adb65a8f4580dc00f"
       or SHA1 == "283cc2f06267ecf2ce70135604ab2ce8deaee9dc"
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256
    | extend HuntType = "Known Malware Hash";
union NetHits, DnsHits, ApkDownloads, HashMatch
| sort by TimeGenerated desc

# TinstaPorn Flutter Gambling Malware — IOC Hunt Script
# OTX Pulse 2026-11-10 | Run via RMM/Intune/PS remoting across endpoints
# Requires: elevated rights for full DNS cache + proxy log coverage

$C2Indicators = @(
    'zc.nationbj.com',
    'api.cloudfareproxy2618.xyz',
    'api.testylhg24.online',
    'hsreg.youkureg510.xyz',
    'line.yongli250627linecfg.xyz'
)
$MalwareHashes = @{
    'SHA256' = 'd9020e64482821585245bf29fc96a046395b33d8e1830e17eeb949a2eb16a4d0'
    'SHA1'   = '283cc2f06267ecf2ce70135604ab2ce8deaee9dc'
    'MD5'    = '70766c883b45404adb65a8f4580dc00f'
}
$Findings = @()

Write-Host '[*] Checking DNS client cache for C2 resolutions...' -ForegroundColor Cyan
Get-DnsClientCache -ErrorAction SilentlyContinue | ForEach-Object {
    foreach ($ioc in $C2Indicators) {
        if ($_.Entry -like "*$ioc*") {
            $Findings += [PSCustomObject]@{ Type='DNS Cache'; Host=$env:COMPUTERNAME; Indicator=$_.Entry; Detail="Data: $($_.Data)" }
        }
    }
}

Write-Host '[*] Scanning user download directories for APK files and hash matches...' -ForegroundColor Cyan
$UserProfiles = Get-ChildItem 'C:\Users' -Directory -ErrorAction SilentlyContinue
foreach ($profile in $UserProfiles) {
    $searchPaths = @("$($profile.FullName)\Downloads", "$($profile.FullName)\Desktop", "$($profile.FullName)\Documents")
    foreach ($path in $searchPaths) {
        if (Test-Path $path) {
            Get-ChildItem $path -Recurse -Include *.apk -ErrorAction SilentlyContinue | ForEach-Object {
                $sha256 = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
                $verdict = if ($sha256 -eq $MalwareHashes['SHA256']) { 'KNOWN MALWARE - TinstaPorn' } else { 'APK present - triage required' }
                $Findings += [PSCustomObject]@{ Type='APK File'; Host=$env:COMPUTERNAME; Indicator=$_.FullName; Detail="SHA256: $sha256 | $verdict" }
            }
        }
    }
}

Write-Host '[*] Checking active network connections to C2 IPs...' -ForegroundColor Cyan
foreach ($ioc in $C2Indicators) {
    try {
        $resolved = Resolve-DnsName $ioc -ErrorAction Stop | Where-Object { $_.IPAddress }
        foreach ($r in $resolved) {
            $conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -eq $r.IPAddress -and $_.State -eq 'Established' }
            foreach ($c in $conns) {
                $proc = (Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue).ProcessName
                $Findings += [PSCustomObject]@{ Type='Active Connection'; Host=$env:COMPUTERNAME; Indicator="$ioc ($($r.IPAddress))"; Detail="PID $($c.OwningProcess) - $proc" }
            }
        }
    } catch {}
}

Write-Host '[*] Checking hosts file for tampering...' -ForegroundColor Cyan
$hostsFile = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $hostsFile) {
    Get-Content $hostsFile | ForEach-Object {
        foreach ($ioc in $C2Indicators) {
            if ($_ -match [regex]::Escape($ioc)) {
                $Findings += [PSCustomObject]@{ Type='Hosts File Entry'; Host=$env:COMPUTERNAME; Indicator=$ioc; Detail=$_ }
            }
        }
    }
}

if ($Findings.Count -gt 0) {
    Write-Host "[!] $($Findings.Count) finding(s):" -ForegroundColor Red
    $Findings | Format-Table -AutoSize
    $Findings | Export-Csv ".\TinstaPorn_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
} else {
    Write-Host '[+] No TinstaPorn indicators found on this host.' -ForegroundColor Green
}