Having Teen Patti fun? Beware of malware apps! Shreshta Threat Intelligence team have detected many websites providing Teen Patti game downloads infected with malware.
About Teen Patti
Teen Patti is a gambling card game. Teen Patti originated in India and is popular throughout South Asia. It evolved from the English game of three-card brag, with influences from poker and the American card game. It is also called flush or flash in some areas.
Executive Summary
Recent intelligence gathered by Shreshta reveals an increase in malicious APKs (Android application packages) disguised as the popular gambling app, Teen Patti. These fraudulent APKs are distributed through various social media channels and messaging platforms to lure unsuspecting users. By clicking on these links, users unknowingly download and install potentially harmful software onto their Android devices.
Our analysis of these websites indicates that they primarily target the Teen Patti user base. With most users downloading the Teen Patti app for fun, users not following cyber hygiene, become an easy target.
Motive
The motive of the threat actors is to propagate malicious APKs to harvest Personally Identifiable Information (PII) of the user.
Teen Patti Malicious APKs circulated on social media targeting Android users
We will explore the websites that are propagating the malicious Android APKs under the disguise of Teen Patti game.
Dangerous Teen Patti Fun
Teen Patti website #1 propagating malware
Figure 1 – Homepage of the website
Figure 2 – APK detected as malicious on VirusTotal
Hash of the APK is detected as Txt.Malware.Agent-9913425-0 and PUA.AndroidOS.ScamApp
Teen Patti website #2 propagating malware
Figure 3 – Home page of the website prompting the user to download the APK
Figure 4 – Hash of the APK is detected as malicious on VirusTotal
Hash of the APK is detected as TPUA.AndroidOS.Spyloan and TROJ_GEN.R002V01KG23
Teen Patti website #3 propagating malware
Figure 5 – Home page of the website prompting the user to download the APK
Figure 6 – Hash of the APK is detected as malicious on VirusTotal
VirusTotal is detecting the hash of the APK as TROJ_GEN.R002V01KH23
Teen Patti website #4 propagating malware
Figure 7 – Home page of the website prompting the user to download the APK
Figure 8 – Hash of the APK is detected as malicious on VirusTotal
Hash of the APK is detected by VirusTotal as A Variant Of Android/Packed.Jiagu.D Pote, PUA.AndroidOS.Jiagu, Riskware/PackagingUntrustworthyJiagu!, Trojan ( 0052d2661 ) and TROJ_GEN.R002V01KG23.
Teen Patti website #5 propagating malware
Figure 9 – Home page of the website prompting the user to download the APK
Figure 10 – Hash of the APK is detected as malicious on VirusTotal
Virus Total has detected it as A Variant Of Android/Packed.Jiagu.D Pote, Riskware/PackagingUntrustworthyJiagu!Android, Trojan ( 0052d2661 ) and Android.WIN32.Robtes.dc
Teen Patti website #6 propagating malware
Figure 11 – Home page of the website impersonating the Google Play store and prompting the user to download the APK
Figure 12 – Hash of the APK is detected as malicious on VirusTotal
Hash of the APK is detected by Virus Total as PUP/Android.Malct.1196223, Android.Riskware.Agent.KKZ and Android Packed App (PUA)
Teen Patti website #7 propagating malware
Figure 12 – Home page of the website impersonating the Google Play store and prompting the user to download the APK
Figure 13 – Hash of the APK is detected as malicious on VirusTotal
VirusTotal is detecting the hash of the APK as TROJ_GEN.R002V01KG23.
Safety Recommendations
- Configure Browse Safe DNS Servers on your devices to block phishing, malware, cryptojacking and other cyber threats.
- Download apps only from the official Google Play Store
- Any website which prompts downloading of an APK file should be treated as malicious
- If you become a victim of cybercrime, call the national (India) cybercrime helpline 1930 or file a complaint at https://cybercrime.gov.in/
- If you are an enterprise, protect your organisation in real-time from cyber threats such as phishing, malware, newly registered domain names and other malicious communication using Shreshta Protective DNS. Please email info@shreshtait.com for a free 30-day trial.
Conclusion
The distribution of websites offering malicious Teen Patti APKs is an alarming trend, posing substantial risks for users. These websites encourage users looking for the Teen Patti game and wanting to have fun, prompting them to download and install the APKs via sideloading and instructing them to enable installation from external sources on their Android devices.
This practice not only jeopardizes user security and privacy but also facilitates the propagation of malware and potential financial exploitation. To mitigate these risks, it’s crucial for users to be cautious when downloading apps and ensure they obtain them only from trusted sources like Google Play Store.
Get free access to Newly registered domain names (NRD) community feeds
Newly registered domain names or recently registered domains can be a potential security risk for organisations. They are often used to host phishing, malware, and other malicious content.
By monitoring or blocking NRDs, enterprises can eliminate the risk of cyber threats posed by NRDs.
Get no-cost access to our newly registered domain names(NRD) community feeds.
Download the free NRD community feeds
Indicators of Compromise
- https[:]//th7.pw/ta/hf59i2?p=wa
- https[:]//share.getfun.in/
SHA-256 hash
- 4dee7b2cf8bc480be8da77569afa7f461ac818786df5739979443c30d2ca3a3f
- 37e1c8e60e57f5ba22721e7b1afe44c68bd7a1a1a9ba5ce88fb4d8b52097d678
- e6cb80b4e5c3b161d68339594ba3391ff81b8a0816839eeb2ee9ee08f2a7b511
- 9b4951f345413cb3c955370c99183cdf91410385a61477fd5eaf60fe117f72e0
- 779b882f61435bf3b7b4d5c04fd2f2891ad97afa492a58ffaf513a27bc7350fa
Suspicious URLs
- https[:]//h25.pw/gold/alxwr
- https[:]//google.teenpattigoo.com/
- https[:]//teenpattiepic.info/
- https[:]//teenpattimaster.biz/
- https[.]//happyteenpatti.in/
- https[.]//dev.playteenpattiearnmoney.com/blogs/teenpatti/teen-patti-master-apk-pndg5mnrtf
- https[.]//share.bigswinner.online/?appKey=nzwvop&af_status=share-link&clickLabel=MA==&agent=levana5
- http[.]//ekteenpatti.com/
- https[.]//google.teenpattigoo.com/
- https[.]//happyteenpattis.com/
- https[:]//ekteenpatti.com/
- https[.]//share.bigswinner.online/?appKey=nzwvop&af_status=share-link&clickLabel=MA==&agent=levana7
- https[.]//h27.in/c/red/m/hj60an?f=w&p=wa&tp=aw1
- https[.]//h27.in/c/red/m/hj60an?f=w&p=wa&tp=aw1
- https[.]//h27.in/aw/2kieo
- https[.]//teenpattivegas.com/?from_gameid=4180310&channelCode=4180305
- https[.]//h27.in/c/red/m/hj60an?f=w&p=wa&tp=aw1
- https[.]//h29.in/gold/twh1a
- https[.]//h29.in/m/twh1a
- https[.]//th7.pw/ta/qpqgd?p=wa
- https[.]//h25.in/m/qpqgd
- https[.]//h25.in/gold/qpqgd
- https[.]//h25.in/sm/qpqgd
- https[.]//share.bigswinner.online/?appKey=nzwvop&af_status=share-link&clickLabel=MA==&agent=levana4
- https[.]//h26.in/c/red/m/6jv1di?f=w&p=default&l=en&tp=m31
- https[.]//nn5.pw/aw/ddvpb
- https[.]//h25.pw/gold/alxwr
- https[.]//teenpatti-3m.com/
- https[.]//teenpatti.cc/download.htm
- http[.]//teenpatticlan.in/
- https[.]//teenpattidownloader.com/
- https[.]//teenpattiepic.info/
- https[.]//teenpattiflush.in/
- https[.]//nn5.pw/aw/4r47j
- http[.]//teenpattigold.xyz/
- https[.]//3pattiroyal.com/?from_gameid=5513258&channelCode=4070402
- https[.]//h27.in/m/sjcg
- https[.]//h27.in/gold/s03q
- https[.]//share.getfun.in/?2jrliqec_2d833h
- https[.]//th7.pw/ta/s03q
- http[.]//teenpattijoy.in/
- https[.]//h29.in/gold/kakx9
- https[.]//h29.in/m/kakx9
- https[.]//h29.in/epic/kakx9
- https[.]//share.getfun.in/?2jrm3qq2_2d833h
- https[.]//h29.in/bws/kakx9
- https[.]//h29.in/sm/kakx9
- https[.]//h29.in/ysl/kakx9
- https[.]//h27.in/sm/hf59i2
- https[.]//th7.pw/ta/hf59i2?p=wa
- https[.]//h27.in/m/ywrh8
- https[.]//h26.in/c/blue/gold/ywrh8?f=w&p=wa&tp=gold1
- https[.]//teenpattimaster.biz/
- https[.]//hh7.pw/aw/mrj2y
- https[.]//h25.in/m/13ksl
- https[.]//h25.in/gold/13ksl
- https[.]//h27.in/gold/13ksl
- https[.]//h26.in/gold/mgmrq
- https[.]//h26.in/m/mgmrq
- https[.]//h25.in/m/tutoa
- https[.]//h27.in/m/teuo01
- https[.]//h26.in/gold/teuo01
- https[.]//h26.in/m/comsr
- https[.]//h26.in/gold/comsr
- https[.]//h27.in/m/tbqy3
- https[.]//h27.in/gold/cvr8eh
- https[.]//h25.pw/aw/r0efo
- https[.]//teenpattiroyal.com/
- https[.]//teenpattiskyapk.com/
- https[.]//teenpatti-sky.com/
- https[.]//teenpattisky.live/
- http[.]//teenpattivipdl.com/
- http[.]//teenpattiyesdl.com/
- http[.]//teenpattiyesfx.com/
- https[.]//share.bigswinner.online/?appKey=nzwvop&af_status=share-link&clickLabel=MA==&agent=levana3
- https[.]//winnerteenpatti.com/
- https[.]//share.bigswinner.online/?appKey=nzwvop&af_status=share-link&clickLabel=MA==&agent=levana2
- https[.]//share.bigswinner.online/?appKey=nzwvop&af_status=share-link&clickLabel=MA==&agent=levana6
Suspicious SHA-256 hash
- c969112fb49d331de57217e4e0dcee965fc385d460cc2f56ade14854d39ea7df
- a95510438290013081b44f14e653363bdc77caedc946c4bea079d9bc989a0238
- 60e821098bf5537e16ab43277af803897872da7186b696f19cfbd93352fd90d8
- 95c3d4b8369dfd69072767a8730bb0cf4d7e1a872b8ea686891c8fdfc8317d1f
- a135127114197f0535945cd7bbdd95c141e29fdcbdef7e32a6ec6d8e3f142ad7
- 6aa506e34fb1be2b2f87bffdac3fa8f0462768a662998b6706635029c1cc0d5c
- 865ae673b65c58edd129934e82ff4a020d9ecf60f1af232273949147297e24f4
- 1e508e64a6027d75e670abee9dd01aea36c0cd5d67377320c0e7d4059d0bdfb8
- 5b391c78192429716afbb1e8c6e49bd529d6068d5c6dd2e52b4ca5c2508af8c3
- 7d701731e7969da1a6c6a048365bf36c2a54dfb69d7274f503681b36b0eaa519
- 70130071ee70841939770a768c9c7cf7152ae7fc1e19491bcac672b1fea95c78
- c5be2658a62b5ef72285088602d9785cd01287ae0b3f88b4c68bf25aca5ba776
- 74f448536a3ec0e1456169fa57da136a13d7b6ffb2a3ba0a77f04cf12883bdd3
- 66f05822a8f85b6519a262dd6645c302935928c645ec5ef738ee8c967227cbaa
- 5b0fe3e8cb6b009bd0edd9984d57697cd2ab4bad59324c3f63978d7a308df260
- 138e7c90080369eb545c8b3e299687a9809daaba9af3112dceef87a89d303e51
- 0b7d891380df3812ac078f81a0a241b3d8bdf0cc99728b4adf8e2fba70434a8d
- 0b7d891380df3812ac078f81a0a241b3d8bdf0cc99728b4adf8e2fba70434a8d
- a2c582b5652325aa3d68237c1a3366075faa79ed0dd52a422c3891d31e495d40
- d434497382c5da07911bbe336b02c98165cbbf62bf02f60b1cb3159ea278d2fc
- 85fa1aeb04b3b6f4dccee8d1d48f6f5a51b06cc3cb4b3cd11b5633b3e253f885
- 5afe74953c5a4ae921b08827a9b9cecb2c0a8917dae1c9dd93908b5b2d0ed75a
- 5f56d6b83b79e82c8114baf65d4518832689897232c556a00203470f4d1a3620
- 333ae58c79f95840ba4f65faf4331c6f54262536a5370affe2eea5dfbbe3d797
- e869edc2c43d9702e01b1bc3091bb2a60e2159d2213491f9d9b1fd4c843b9e28
- 2ad34362be8666a46d737880c22b8c91ce51562b41fa04c5991369564cbd1af4
- ae88577c150bc124f99df7b18a623a1e3094f479e0760934d194cc0bd4fc5c3e
- 2dd01aa0d7ed4033075105abaa6d603cdf404e69ea1b3220fbc956769fbd5db0
- 82f65f151ebba5fbcbc79b263ec06d1031bc0081be035a91d8fc8e44c9a6869c
- 57a363b4f0731ed0f7aebeb867e06546cc63d570878e04154ae4f58cf110b614
- ac08725b3c60538ed4ad692c626f6240e336da5b80747d5f006d75dab40980c8
- 43191ecffd2d8d1fff3f96b1c6d7411bf8d5c98cbb943e14f7521b88e884f521
- 37e1c8e60e57f5ba22721e7b1afe44c68bd7a1a1a9ba5ce88fb4d8b52097d678
- 86b4165f182d781ea47e6e8138ad88bd36b52121859ba2b926abe97e41eb8fe6
- e7615fb9cd92494d46393af1d440f76e1621997041e1ad1e191a86564f7fae0b
- 3df6454f384a49ff8c7ea221733fde63e27610fd34458c24a1378c9c9d2d5e34
- d7709d9480873bd1c5e472b960833fba25d1fba9ce6aa41996908fb768a18139
- a421ebab9abe154d4fed53b6a200cd319061f398613b15b225fdda0848283e79
- e8222a633f81e7c49b08b090a4af71c30f267eb9c956f7c2171b659ca3a5d822
- 59ffe36febcd5e5084bd0b8453494d5bcb09268396ecbb7b00954cd0ed6bc763
- c8b9b4f40ff15d7fd4a513bcafa6ddbb4b5d34788b034aa017f7449afaaa49bc
- 19962507f5b22a39c06f0ec8bdf03ac865ddad5a0e6d030d2fda4bc8d9627db9
- 825f6f1f164e1fb5574c1a378e53598c391d4109021a3ab109eb9333a3468e9d
- 45b43e48e07f2085d4c1380d9eb21eb3b7d12343eacd4e8c9c7f5bff4ff0063a
- be9da138f917c69e41539dc5f12f48e45fc2750e3cead014e5028dba9579c141
- 9cffb50814e3f4006c176b1986560a77927e3ca9180657170d99f84ca554ff67
- ed3a0cd4a436229edf30f0939103841d8c6db4002375112b71e0e5aa685bdb16
- a7ef50708eca2beb0a36a02c1aa912a228058d2281afa5895cc224890165d4ed
- c3cf387b6ff5e61c6816566f71b87799cdeefd4aba4d1e8c94d3634b9a3118b4
- c05f0abbaa9d81311c3a94abf1828538c3a629b26ce68f5877c61f1fb7d4ba8a
- 931bed63fa181f2c5400853b3f49eaa6df67ab79c26e0f3e343cde945085bf0f
- 0fcbe38b15810f8cc3996e07eef43ee3c11242c59fa5b5ed7dd6e51a33b9f279
- 732da3ca2249a6791d306420b9010a0351f20970c98a3275f3c3ec083d17b24c
- 30f9f07453f75e738da0e81caf257afcb23a374053da42496ffe0f9d3cb2225b
