Affected Platforms: Android
Impacted Users: Android end-users
Impact: Geolocation and phone number leak, money loss through gambling and addiction exploitation
Severity Level: Medium

Flutter is an open-source UI framework developed by Google that uses using the Dart programming language to build Android, iOS, web, and desktop applications from a single codebase.

Flutter caught our attention for its use in malware development, and we presented several malware samples built with the framework at Virus Bulletin 2024. Malware authors are drawn not only to its ease of cross-platform implementation, but also by a side effect: Flutter is notoriously difficult for malware analysts to reverse-engineer, giving the malware a better chance of going unnoticed.

The analysis issue stems from Flutter's technical specifics: specific registers, a different ABI, etc., and consequently a lack of adapted tooling. In 2024, the best available tools were Blutter and JEB. Fortunately, this has improved in 2026, and we now have better solutions: r2flutter, Bytecode Studio, and AI support within the disassembler (r2ai).

In the following report, we present an analysis of a very recent Android Flutter malware (Oct 5) named Android/TinstaPorn.A!tr.

Meet TinstaPorn

Despite its name, TinstaPorn is not a porn-related app but an illegal online gambling platform. It poses as an online clone of a famous casino in Macau to attract victims.

Victims play online casino games (slots, roulette, etc.) in which the mathematical odds are rigged in the cybercriminals’ favor. The platform fuels compulsive gambling through VIP recharges, rebate offers, and referrals. Beyond financial loss, the malware exfiltrates sensitive information, including phone numbers and geolocation data.

C2 Config Servers, Registration Servers, Line Selection Servers, and Game Servers

Bootstrap config servers

Initially, the malware contacts one of two hard-coded configuration servers:

• hxxps://gitee[.]com/lspxgit/nocode/raw/master/address[.]txt: this URL has been taken down.
• hxxps://github[.]com/googleaidog/nocode/blob/master/address[.]txt: a backup configuration server hosting an old configuration.

The C2s carry no code (there’s a hint in the repository’s name, nocode) but only configuration. They respond with a list of registration servers, surrounded by the markers bydbikestart and bydbikeend:

• bydbikestart|hxxps://zc.nationbj[.]com/device/register
• hxxps://reg.gitshreg611[.]xyz/device/register|bydbikeend

Registration servers

The malware attempts to register the device with one of these registration servers. It posts to the endpoint /device/register (including device identification data, model, etc.) and receives a “line configuration” server in return.

If none of the registration servers are available, the code includes a list of six hard-coded registration servers.

Line configuration servers

Same mechanism again: the malware tries to reach one of the available “line configuration” servers via the /svrlist endpoint. If no line configuration server responds, the malware uses two hardcoded URLs and provides backup URLs for line configuration servers.

• hxxps://gitee[.]com/lspxgit/yongli/raw/main/helpline[.]txt
• hxxps://raw.githubusercontent[.]com/kaerkaerkaerzzz/yongli/main/helpline[.]txt

The line configuration servers normally return a list of available game servers. However, if no game server is available, the malware tries six different hardcoded servers.

Game servers

The app caches the available game servers locally in its SQLite database. Each game server has a few parameters, such as an AES encryption key for communication:

• did: server identifier (uncertain)
• aes_key: encryption key for traffic with the game server
• api_protocol: http or https
• api_host: game server URL

The fastest game server is selected, and the victim can start playing. The game servers provide many endpoints, as listed in Table 1.

At first, the victim is authenticated and receives a user token by a POST to /app/login/mobile-sms. The server potentially serves rebates through endpoints such as /app/rebate/today, and only then does the victim really start playing /game/enter.

Table 1: Non exhaustivePartial list of game server endpoints

Data Exfiltration

Data exfiltration occurs at several points

1. Log server. Just before a game server is selected, the malware posts information to the log server at hxxps://up.logupload0628[.]xyz/app/log/raw/report. Although the information is not highly sensitive (see Table 2), it allows the backend to fingerprint the victim.
2. Game server. Several endpoints handle sensitive information. For example, the victim’s geographic location is posted to /loc/geo-location with latitude, longitude, accuracy, and a timestamp. The phone number is posted to the endpoint /app/profile/modify-delivery or /bind_phone.

Table 2: Not tooLess sensitive data posted to the log server

Table 3: Sensitive information posted by the malware to its game servers

Game Server Communication

All communication with the game servers is authenticated and encrypted. The AES encryption key is included in the /srvlist response from the line configuration servers (field aes_key). For authentication, all requests are signed with HMAC-SHA256, a keyed hash message authentication code that computes the hash of a message and a shared secret (the AES key in our case).

Because the AES key is returned in cleartext from the line config servers, the purpose is not to address confidentiality or integrity against a third party, but rather to obfuscate content and check for communication errors.

Conclusion

This malware is not “garage” or student-level work. It reflects well-planned development, with a clean infrastructure, multiple REST APIs, and a full ecosystem. In 2024, with limited reverse engineering tooling, this Flutter application would have taken ages to reverse engineer. In 2026, however, it’s merely a hard day’s work. It’s always good news to hear that cybercriminals are losing their edge.

Fortinet Protections

The malware described in this report is detected and blocked by FortiGuard Antivirus as:

• Android/TinstaPorn.A!tr (SIGID: 815959)

FortiGate, FortiMail, FortiClient, and FortiEDR support the FortiGuard AntiVirus service. The FortiGuard AntiVirus engine is part of each of these solutions. As a result, customers who have these products with up-to-date protections are protected.

The FortiGuard Web Filtering Service blocks the servers.

Organizations seeking to strengthen foundational security awareness may also consider completing Fortinet Certified Fundamentals (FCF) training in Cybersecurity. This module is designed to help end users learn how to identify and protect themselves from phishing attacks.

The FortiGuard IP Reputation and Anti-Botnet Security Service proactively blocks infrastructure associated with this campaign by correlating malicious IP intelligence collected from Fortinet’s global sensor network, CERT collaborations, MITRE, trusted industry partners, and other intelligence sources.

If you believe this or any other cybersecurity threat has impacted your organization, please contact our Global FortiGuard Incident Response Team.

IOCs

URLs

hxxps://gitee[.]com/lspxgit/nocode/raw/master/address[.]txt
hxxps://github[.]com/googleaidog/nocode/blob/master/address[.]txt
hxxps://zc.nationbj[.]com]/device/register
hxxps://reg.gitshreg611[.]xyz/device/register
hxxps://gitee[.]com/lspxgit/yongli/raw/main/helpline[.]txt
hxxps://raw.githubusercontent[.]com/kaerkaerkaerzzz/yongli/main/helpline[.]txt
hxxps://www.game250522linecfg[.]xyz
hxxps://www.ylhg250627linecfg[.]xyz
hxxps://www.tt250627linecfg[.]xyz
hxxps://line.yongli250627linecfg[.]xyz
hxxps://api.cloudfareproxy2618[.]xyz
hxxps://api.testylhg24[.]online
hxxps://up.logupload0628[.]xyz/app/log/raw/report
hxxps://reg.alibabareg0303[.]com
hxxps://reg.baidureg0627[.]xyz
hxxps://reg.baidureg0621[.]xyz
hxxps://hsreg.youkureg510[.]xyz
hxxps://reg.gptreg0706[.]xyz

Files

d9020e64482821585245bf29fc96a046395b33d8e1830e17eeb949a2eb16a4d0