Threat feed

uCreator / YingGai

uCreator (YingGai): commercial Android platform exposes Telegram credential-capture and WeChat account-cloning capabilities in repackaged apps

Posted · Updated · Spectrum Delta Research Team

Summary

Independent researcher Ovi (Oct 21, B/3) exposes uCreator — the vendor's own name for the product is YingGai — a commercial Android surveillance platform built around Chinese 'mass control' (群控): a VirtualApp/LSPatch engine, a library of per-application hook modules, a Redis and HTTP control plane, a cloud-phone farm with live screen control, and a Windows operator console, rented to customers who aim its capabilities at victims they pick. The code-confirmed target roster covers about 20 applications including GCash, WeChat, WeCom, QQ, Telegram, WhatsApp, LINE, Zalo, KakaoTalk, Viber and MoMo. Delivery is not a standalone spyware app: thin repackaged copies of legitimate apps (Telegram-X / Telegram-Web, WeChat, GCash) merged via LSPatch or injected from assets/TgJarPine.dex via Pine, or the untouched app run inside the vendor's 'Onion Box' VirtualApp container, with target-specific instrumentation fetched after installation from operator Alibaba OSS and MinIO storage. Inside the app, the recovered code can hook the SRP proof routine to capture Telegram's two-step-verification password in cleartext before it is hashed, issue live SQL queries through Telegram's own MessagesStorage database handle, remove its own session from the account's device-authorization list, and clone WeChat accounts by extracting the login identity and re-running login with a bundled script; code-confirmed support also covers OTP interception, wallet data extraction and camera spoofing intended to defeat KYC liveness checks. A leaked operator backend on an open GitLab server shows a rentable cloud console, customer-ID-tagged commands, and 'account cultivation' schedulers whose randomized limits and budgets are designed to evade platform risk checks. The Telegram component is the same backdoor Doctor Web reported as Baohuo in October 2025 (Android.Backdoor.Baohuo.1.origin, 58,000 devices). The author states the report is an analysis of technical capability, not a measurement of victim impact, and that what the code establishes should be distinguished from what has been exercised end-to-end; the counted procedures of this card are the delivery and the control-channel connections, which standard telemetry records.

Breakdown

Adversary

uCreator's operators — a Chinese commercial surveillance-software vendor

Procedures (2)

  1. Sideloaded repackaged app fetches module post-install

    Delivery: thin repackaged messenger installs, then fetches its module after installation

    • T1204.002User Execution: Malicious File

    Logs

    • Android package install events · sideloaded messenger APK installs; cache/lspatch/origin APK copies
    • Network and proxy · post-install OSS/MinIO module fetches (Huuk_* buckets); Redis/MQTT C2
    • Device file telemetry · TgJarPine.dex in tampered Telegram assets; cache/lspatch/origin APK copies

    Detectors

    • Dr.Web Android.Backdoor.Baohuo.1.origin (package) · tampered Telegram X package (com.ucreator.tgjar) detected
    • Ovi host-side hunt signatures (author-attested) · TgJarPine.dex asset; cache/lspatch/origin APK copies
Click to expand remaining (1) procedure

  1. Device connects to operator Redis, MQTT and OSS C2

    Command and control: device connects to operator Redis, MQTT and OSS infrastructure

    • T1071Application Layer Protocol

    Logs

    • Network and proxy · post-install OSS/MinIO module fetches (Huuk_* buckets); Redis/MQTT C2
    • DNS · operator domains incl telegram-apk.uzyzx.com; six domains, dozens of subdomains

    Detectors

    No known detector

Indicators of compromise

Hunt only

((Ovi (https://www.0x0v1.com/ucreator-virtualization-based-android-spyware-platform-targeting-wechat-telegram-and-other-messaging-apps/), B/3)) — reliable device traces per the primary: TgJarPine.dex in tampered Telegram assets; original app copy at cache/lspatch/origin/*.apk (LSPatch artifact). Sample SHA-256s: 2fc4bad71eda25b9022ea7cb090d6419911ecd67e50e746b418f8a617a980301 (com.ucreator.tg, framework and command handlers); 0142749a159be3e41d28f910eebf28b577a282880bd0c2383bd7404189f4ff94 (com.uckj.tgx, loader). Code namespace com.ucreator.* / com.uckj.*. Post-install fetch URLs from the primary: kfpt.oss-cn-hangzhou.aliyuncs.com/android/app/YingGai/Huuk_TG/tghuuk_PATCH002_updateinfo; paas.minio.opsapi.cn/fengzhuang-app/hook-tg/tghuuk_PATCH002_updateinfo.json; kfpt.oss-cn-hangzhou.aliyuncs.com/android/app/YingGai/contacts.vcf; hpncallback.qianxunlbs.com/api/callback/TgHeartCallback. Operator core on Aliyun + Huawei Cloud under qianxuncc.cn / videoflow.cn / ops*.cn, fronted by a tengine gateway and a .NET Ocelot cloud-phone backend with SRS/RTMP media nodes hosted in Changsha; OSS buckets kfpt (exfil + hooks) and ops-yunguan; three Redis buses, two MQTT endpoints; throwaway callback/distribution domains (qianxunlbs.com, uzyzx.com, gold5play subdomains) already NXDOMAIN while the core gateways stay up. Vendor container app 'Onion Box' (洋葱盒子); Windows operator console uip.exe; LoginWeChat_v1.0.1.js cloning script; contacts.vcf address-book lift. Backend: self-hosted GitLab (exposed, not IP-restricted), rentable cloud console, customer-ID-tagged commands, ~36 developers on China time with changes still added October 2026. Artifact timeline: uip.exe builds Feb–Dec 2024; Telegram repacks Jul and Nov 2024; va_vx WeChat host and tg framework Dec 2024; Onion Box client Mar 2026. Component context: Doctor Web Android.Backdoor.Baohuo.1.origin — 58,000 devices, mainly Indonesia and Brazil, spreading since mid-2024 via in-app ads to fake app-store sites (Doctor Web (https://news.drweb.com/show/review/?lng=en&i=15102), B/2). Assessed 2026-10-26, hunt-only — the package artifacts (TgJarPine.dex, LSPatch cache copies, com.ucreator.* namespace) are durable; operator domains and storage buckets are perishable commercial infrastructure; the author explicitly calls the report an analysis of technical capability, not a measurement of victim impact.

Detailed

Device-side reliable traces per the primary: TgJarPine.dex in the assets of some tampered Telegram copies; the original app copy LSPatch leaves at cache/lspatch/origin/*.apk. Sample SHA-256s: 2fc4bad71eda25b9022ea7cb090d6419911ecd67e50e746b418f8a617a980301 (com.ucreator.tg — framework and command handlers); 0142749a159be3e41d28f910eebf28b577a282880bd0c2383bd7404189f4ff94 (com.uckj.tgx — loader). Namespaces: com.ucreator.*, com.uckj.*; vendor branding YingGai; the Baohuo match is by code namespace com.ucreator.tgjar, same C2 and matching command names per Doctor Web's technical description. Post-install fetch and callback URLs: kfpt.oss-cn-hangzhou.aliyuncs.com/android/app/YingGai/Huuk_TG/tghuuk_PATCH002_updateinfo; paas.minio.opsapi.cn/fengzhuang-app/hook-tg/tghuuk_PATCH002_updateinfo.json; kfpt.oss-cn-hangzhou.aliyuncs.com/android/app/YingGai/contacts.vcf; hpncallback.qianxunlbs.com/api/callback/TgHeartCallback. Infrastructure: operator core on Aliyun + Huawei Cloud under qianxuncc.cn / videoflow.cn / ops*.cn; tengine gateway; .NET Ocelot cloud-phone backend with SRS/RTMP media nodes hosted in Changsha; three Redis buses; two MQTT endpoints; OSS buckets kfpt (exfil + hooks) and ops-yunguan; throwaway domains (qianxunlbs.com, uzyzx.com, gold5play subdomains) already NXDOMAIN while core gateways stay up. Vendor artifacts: Onion Box (洋葱盒子) container app; Windows operator console uip.exe (builds February–December 2024); LoginWeChat_v1.0.1.js cloning script; contacts.vcf address-book lift. Backend: self-hosted GitLab (exposed, not IP-restricted), rentable cloud console, customer-ID-tagged commands, ~36 developers on China time with changes still added October 2026. Artifact timeline: Telegram repacks July and November 2024; va_vx WeChat host and tg framework December 2024; Onion Box client March 2026. Target applications (~20, code-confirmed): GCash, WeChat, WeCom, QQ, Telegram, WhatsApp, LINE, Zalo, KakaoTalk, Viber, MoMo. Component context: Doctor Web Android.Backdoor.Baohuo.1.origin — 58,000 devices, mainly Indonesia and Brazil, spreading since mid-2024 via in-app ads to fake app-store sites. All from the primary unless attributed (Ovi (https://www.0x0v1.com/ucreator-virtualization-based-android-spyware-platform-targeting-wechat-telegram-and-other-messaging-apps/), B/3); (Doctor Web (https://news.drweb.com/show/review/?lng=en&i=15102), B/2).

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of uCreator / YingGai? Bring them to the community.

Discuss in the Tradecraft Slack