{"id":5552,"date":"2024-02-03T08:55:01","date_gmt":"2024-02-03T08:55:01","guid":{"rendered":"https:\/\/shreshtait.com\/blog\/?p=5552"},"modified":"2024-02-05T07:35:14","modified_gmt":"2024-02-05T07:35:14","slug":"having-teen-patti-fun-beware-of-malware-apps","status":"publish","type":"post","link":"https:\/\/shreshtait.com\/blog\/2024\/02\/having-teen-patti-fun-beware-of-malware-apps\/","title":{"rendered":"Having Teen Patti fun? Beware of malware apps!"},"content":{"rendered":"\n

Having Teen Patti fun? Beware of malware apps! Shreshta Threat Intelligence<\/a> team have detected many websites providing Teen Patti game downloads infected with malware.<\/p>\n\n\n\n

About Teen Patti<\/strong><\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Teen Patti<\/a> is a gambling card game. Teen Patti originated in India and is popular throughout South Asia. It evolved from the English game of three-card brag, with influences from poker and the American card game. It is also called flush or flash in some areas. <\/p>\n\n\n\n

<\/div>\n\n\n\n

Executive Summary<\/strong><\/h2>\n\n\n\n

Recent intelligence gathered by Shreshta reveals an increase in malicious APKs (Android application packages) disguised as the popular gambling app, Teen Patti. These fraudulent APKs are distributed through various social media channels and messaging platforms to lure unsuspecting users. By clicking on these links, users unknowingly download and install potentially harmful software onto their Android devices.<\/p>\n\n\n\n

Our analysis of these websites indicates that they primarily target the Teen Patti user base. With most users downloading the Teen Patti app for fun, users not following cyber hygiene, become an easy target. <\/p>\n\n\n\n

<\/div>\n\n\n\n

Motive<\/strong><\/h2>\n\n\n\n

The motive of the threat actors is to propagate malicious APKs to harvest Personally Identifiable Information (PII) of the user. <\/p>\n\n\n\n

<\/div>\n\n\n\n

Teen Patti Malicious APKs circulated on social media targeting Android users<\/strong><\/h2>\n\n\n\n

We will explore the websites that are propagating the malicious Android APKs under the disguise of Teen Patti game.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Dangerous Teen Patti Fun<\/strong><\/h2>\n\n\n\n

Teen Patti website #1 propagating malware<\/strong><\/p>\n\n\n\n

<\/p>\n\n\n\n

Figure 1 – Homepage of the website <\/p>\n\n\n\n

<\/div>\n\n\n\n

<\/p>\n\n\n\n

Figure 2 – APK detected as malicious on VirusTotal<\/p>\n\n\n\n

Hash of the APK is detected as Txt.Malware.Agent-9913425-0 and PUA.AndroidOS.ScamApp<\/p>\n\n\n\n

<\/div>\n\n\n\n

Teen Patti website #2 propagating malware<\/strong><\/p>\n\n\n\n

<\/p>\n\n\n\n

Figure 3 – Home page of the website prompting the user to download the APK<\/p>\n\n\n\n

<\/div>\n\n\n\n

<\/p>\n\n\n\n

Figure 4 – Hash of the APK is detected as malicious on VirusTotal<\/p>\n\n\n\n

Hash of the APK is detected as TPUA.AndroidOS.Spyloan<\/a> and TROJ_GEN<\/a>.R002V01KG23<\/p>\n\n\n\n

<\/div>\n\n\n\n

Teen Patti website #3 propagating malware<\/strong><\/p>\n\n\n\n

<\/p>\n\n\n\n

Figure 5 – Home page of the website prompting the user to download the APK<\/p>\n\n\n\n

<\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Figure 6 – Hash of the APK is detected as malicious on VirusTotal<\/p>\n\n\n\n

VirusTotal is detecting the hash of the APK as TROJ_GEN<\/a>.R002V01KH23<\/p>\n\n\n\n

<\/div>\n\n\n\n

Teen Patti website #4 propagating malware<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Figure 7 – Home page of the website prompting the user to download the APK<\/p>\n\n\n\n

<\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Figure 8 – Hash of the APK is detected as malicious on VirusTotal<\/p>\n\n\n\n

<\/div>\n\n\n\n

Hash of the APK is detected by VirusTotal as A Variant Of Android\/Packed.Jiagu<\/a>.D Pote, PUA.AndroidOS.Jiagu, Riskware\/PackagingUntrustworthyJiagu!, Trojan ( 0052d2661 ) and TROJ_GEN<\/a>.R002V01KG23. <\/p>\n\n\n\n

<\/div>\n\n\n\n

Teen Patti website #5 propagating malware<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Figure 9 – Home page of the website prompting the user to download the APK<\/p>\n\n\n\n

<\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Figure 10 – Hash of the APK is detected as malicious on VirusTotal<\/p>\n\n\n\n

<\/div>\n\n\n\n

Virus Total has detected it as A Variant Of Android\/Packed.Jiagu<\/a>.D Pote, Riskware\/PackagingUntrustworthyJiagu!Android, Trojan ( 0052d2661 ) and Android.WIN32.Robtes.dc<\/p>\n\n\n\n

<\/div>\n\n\n\n

Teen Patti website #6 propagating malware<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Figure 11 – Home page of the website impersonating the Google Play store and prompting the user to download the APK<\/p>\n\n\n\n

<\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Figure 12 – Hash of the APK is detected as malicious on VirusTotal<\/p>\n\n\n\n

<\/div>\n\n\n\n

Hash of the APK is detected by Virus Total as PUP\/Android.Malct.1196223, Android.Riskware.Agent<\/a>.KKZ and Android Packed App (PUA<\/a>)<\/p>\n\n\n\n

Teen Patti website #7 propagating malware<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Figure 12 – Home page of the website impersonating the Google Play store and prompting the user to download the APK<\/p>\n\n\n\n

<\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Figure 13 – Hash of the APK is detected as malicious on VirusTotal<\/p>\n\n\n\n

<\/div>\n\n\n\n

VirusTotal is detecting the hash of the APK as TROJ_GEN<\/a>.R002V01KG23. <\/p>\n\n\n\n

<\/div>\n\n\n\n

Safety Recommendations<\/strong><\/h2>\n\n\n\n
    \n
  1. Configure Browse Safe<\/a> DNS Servers on your devices to block phishing, malware, cryptojacking and other cyber threats.<\/li>\n\n\n\n
  2. Download apps only from the official Google Play Store<\/a><\/li>\n\n\n\n
  3. Any website which prompts downloading of an APK file should be treated as malicious<\/li>\n\n\n\n
  4. If you become a victim of cybercrime, call the national (India) cybercrime helpline 1930 or file a complaint at https:\/\/cybercrime.gov.in\/<\/a> <\/li>\n\n\n\n
  5. If you are an enterprise, protect your organisation in real-time from cyber threats such as phishing, malware, newly registered domain names and other malicious communication using Shreshta Protective DNS<\/a>. Please email info@shreshtait.com<\/a> for a free 30-day trial.<\/li>\n<\/ol>\n\n\n\n
    <\/div>\n\n\n\n

    Conclusion<\/strong><\/h2>\n\n\n\n

    The distribution of websites offering malicious Teen Patti APKs is an alarming trend, posing substantial risks for users. These websites encourage users looking for the Teen Patti game and wanting to have fun, prompting them to download and install the APKs via sideloading and instructing them to enable installation from external sources on their Android devices.<\/p>\n\n\n\n

    This practice not only jeopardizes user security and privacy but also facilitates the propagation of malware and potential financial exploitation. To mitigate these risks, it’s crucial for users to be cautious when downloading apps and ensure they obtain them only from trusted sources like Google Play Store.<\/p>\n\n\n\n

    Get free access to Newly registered domain names (NRD) community feeds<\/h2>\n\n\n\n

    Newly registered domain names<\/a> or recently registered domains can be a potential security risk for organisations. They are often used to host phishing, malware, and other malicious content.<\/p>\n\n\n\n

    By monitoring or blocking NRDs, enterprises can eliminate the risk of cyber threats posed by NRDs.<\/p>\n\n\n\n

    Get no-cost access to our newly registered domain names(NRD) community feeds.<\/p>\n\n\n\n

    Download the free NRD community feeds<\/a><\/p>\n\n\n\n

    <\/div>\n\n\n\n

    Indicators of Compromise<\/strong><\/h2>\n\n\n\n