EN PT-BR
← Voltar ao feed
medium

Illegal Android gambling app built with Flutter uses HMAC-signed game server APIs and a multi-domain infrastructure

1 fonte(s) · 1 atualização(ões) · publicado 09/11/2026 11:00 · coletado há 1 hora

FortiGuard Labs analyzed an Android gambling application built with Flutter, which it detects as Android/TinstaPorn.A!tr (SIGID 815959). Game communication is authenticated and encrypted: the /srvlist response from the line configuration servers returns an AES key, and every request is signed with HMAC-SHA256 using that key. The author describes the app as well-planned work with a clean infrastructure, multiple REST APIs and a full ecosystem, and says that reversing it would have been far harder in 2024 than it is in 2026. The article does not state the victims, the distribution channel, the targeted markets or the identity of the operators. Because the AES key travels in cleartext, the author judges the encryption a means of obfuscation and error checking rather than protection against a third party. Independent verification was not possible in this research: the Fortinet post could not be opened and no other source on this campaign was found.

Detalhes técnicos

  • The AES key is returned in cleartext in the /srvlist response (field aes_key) from the line configuration servers.
  • All requests to the game servers are signed with HMAC-SHA256, using the AES key as the shared secret.
  • The article reads the crypto as obfuscation and a way to catch communication errors, not as confidentiality or integrity against a third party.
  • The indicators include raw text files on gitee.com and github.com (address.txt, helpline.txt), several /device/register and /app/log/raw/report endpoints, and a large set of look-alike domains with linecfg, reg and api labels.

Remediação

  • FortiGuard Antivirus detects the sample as Android/TinstaPorn.A!tr (SIGID 815959). FortiGate, FortiMail, FortiClient and FortiEDR receive this detection when their protections are up to date.
  • The FortiGuard Web Filtering Service blocks the listed servers, and the FortiGuard IP Reputation and Anti-Botnet service blocks the associated infrastructure.
  • Fortinet recommends Fortinet Certified Fundamentals training so end users can recognise phishing.
  • Organizations that believe they were affected should contact the Global FortiGuard Incident Response Team.

Linha do tempo

  1. feeds.fortinet.com ↗ · pub. 09/11/2026 11:00 · coletado 09/11 12:00 primeiro registro

    Illegal Android gambling app built with Flutter uses HMAC-signed game server APIs and a multi-domain infrastructure

    ler a análise desta fonte

    FortiGuard Labs analyzed an Android gambling application built with Flutter, which it detects as Android/TinstaPorn.A!tr (SIGID 815959). Game communication is authenticated and encrypted: the /srvlist response from the line configuration servers returns an AES key, and every request is signed with HMAC-SHA256 using that key. The author describes the app as well-planned work with a clean infrastructure, multiple REST APIs and a full ecosystem, and says that reversing it would have been far harder in 2024 than it is in 2026. The article does not state the victims, the distribution channel, the targeted markets or the identity of the operators. Because the AES key travels in cleartext, the author judges the encryption a means of obfuscation and error checking rather than protection against a third party. Independent verification was not possible in this research: the Fortinet post could not be opened and no other source on this campaign was found.

    Technical Details

    • The AES key is returned in cleartext in the /srvlist response (field aes_key) from the line configuration servers.
    • All requests to the game servers are signed with HMAC-SHA256, using the AES key as the shared secret.
    • The article reads the crypto as obfuscation and a way to catch communication errors, not as confidentiality or integrity against a third party.
    • The indicators include raw text files on gitee.com and github.com (address.txt, helpline.txt), several /device/register and /app/log/raw/report endpoints, and a large set of look-alike domains with linecfg, reg and api labels.

    Remediation

    • FortiGuard Antivirus detects the sample as Android/TinstaPorn.A!tr (SIGID 815959). FortiGate, FortiMail, FortiClient and FortiEDR receive this detection when their protections are up to date.
    • The FortiGuard Web Filtering Service blocks the listed servers, and the FortiGuard IP Reputation and Anti-Botnet service blocks the associated infrastructure.
    • Fortinet recommends Fortinet Certified Fundamentals training so end users can recognise phishing.
    • Organizations that believe they were affected should contact the Global FortiGuard Incident Response Team.