uCreator malware analysis: Android virtualization steals Telegram 2FA

Overview

A completely original Android device, no jailbreak (non-root), no million dollar zero-day exploit chain, Telegram or WeChat applications still operate smoothly without a trace of lag. However, the two-factor authentication (2FA) password that was just entered was stolen in cleartext right before the encryption algorithm could activate; entire account sessions are silently cloned to a "cloud phone farm"; and the front camera stream was sophisticatedly swapped to bypass banking eKYC biometric tests.

That is how uCreator (internal codename: YingGai - 萤改) - a monthly spying platform (Spyware-as-a-Service) that was discovered in October 2026 - is silently manipulating a series of popular messaging and e-wallet applications in Asia such as Telegram, WeChat, GCash, MoMo and Zalo. Instead of drawing fake screens (overlays) that are easy to detect like traditional banking trojans, how did uCreator do it using only open source virtualization technology?

And the most surprising thing: How could a "malware factory" built according to large-scale enterprise standards - operating with Spring Cloud, Kafka, RocketMQ architecture and a sophisticated "nick maintenance" (养号) algorithm that fools all anti-fraud algorithms - reveal all the secrets of 36 development engineers after just one silly mistake on the GitLab server? The detailed technical analysis and decompilation sections below will decode the entire answer.

Background & Commercial Model Spyware-as-a-Service (MaaS)

Unlike state-sponsored targeted espionage (APT) campaigns that use expensive zero-day exploit chains, uCreator represents the wave of commercialization of espionage tools for financial criminals. The term the development team uses throughout the source code is "Mass Control" (群控) — a concept originally used in social media marketing automation in China, but has been transformed into an industrial-scale victim device management platform.

The system is designed according to multi-tenant architecture:

• Platform Vendor: Responsible for maintaining the virtualization framework, continuously updating hook modules for each target application as developers release new versions, and maintaining the core infrastructure and control ports.
• Resellers & Merchants: Cybercriminal groups rent access to web-based control consoles or Windows desktop applications (uip.exe). Each action sent to the device is labeled with a customer identifier (merchant_id), allowing each criminal group to independently manage its own set of devices and victim data.
• Purpose of exploitation: Collect OTP codes, steal 2FA passwords, forge front camera data to bypass the electronic customer identification process (eKYC liveness check) at digital banks and e-wallets, thereby performing account takeover (ATO) and money laundering.

Development Timeline & Evolution Traces (2014 – 2026)

• 2014: Recorded Android application package called com.ucreator.autotool, serving basic automated macro tasks on the device.
• Period 2016 - 2019: Windows-based control toolkits linked to the ucreater.com domain appeared, digitally signed with a valid Authenticode certificate from a Chinese enterprise.
• September 2021: The mobile product label "YingGai" officially appeared in the development team's documents and archives.
• 2024: Outbreak of research samples: binary uip.exe compiled between February and December 2024; Revised Telegram versions appeared in July and November 2024; WeChat sandbox va_vx module completed in December 2024. The Chinese Internet License (ICP) registration portal of the C2 server qianxuncc.cn bearing the number 湘ICP备2024061212号 was issued this year.
• March 2026: Container client "洋葱盒子" appeared (Onion Box, package com.ucreator.va_yjb_client).
• October 2026: Ovi researcher discovered GitLab server publicly exposed, decoding microservices structure and commit chain of the development team.

In-depth Technical Analysis

Repackaging & In-Process Instrumentation

The victim did not install an application called "spyware". Attackers trick users into downloading trojanized/repackaged versions of official applications such as Telegram-X, Telegram-Web, WeChat or GCash through impersonated websites such as telegram-apk.uzyzx[.]com or external download links.

When a user installs and launches it, the malicious application is actually a wrapper that has been integrated with the LSPatch framework (a rootless version of the Xposed Framework). A special feature is that the manufacturer's original APK file is still kept intact and temporarily stored at the path:

/data/data/<package_name>/cache/lspatch/origin/*.apk

The presence of the APK file at this link is an important host-based signature that helps mobile security solutions detect that the device has been tampered with. Instead of pre-packaging heavy malware into the original installation file, the repackaged APK only serves as a thin loader. The specific intervention source code for each application is dynamically loaded from the resource file assets/TgJarPine.dex or downloaded from object storage servers such as Alibaba Cloud OSS or MinIO when there is a network connection.

Virtualization technology: Comparing uCreator and GodFather Trojan

To clarify the level of danger and evolution of uCreator, it is necessary to compare it with GodFather - one of the notorious banking trojans once recognized by security firm Zimperium for its use of virtualization technology.

While GodFather launches the banking application inside a virtual container and then draws a phishing overlay layer on top to trick victims into entering login information, uCreator does not use any overlay layer at all. The malware penetrates directly into the memory address space of a legitimate process through XposedBridge.hookAllMethods, using Java reflection to manipulate the target application's internal object classes. This means that the malicious code operates with full permissions, identifiers and trusted certificates that the Android operating system allocates to that valid application.

Pine Engine & Compatibility Testing on Android 16/17 (Hidden-API Bypass)

At the heart of the rootless intervention technique is Pine Engine — an inline hook library specifically for the Android Runtime virtual machine (ART). However, since Android 9 (Pie), Google has tightened its policy of restricting access to internal framework interfaces that are not part of the official SDK (non-SDK / hidden APIs). To work, virtualization tools must bypass the Hidden-API Enforcement mechanism through two ways:

1. Call the hidden method VMRuntime.setHiddenApiExemptions to register the exemption list at run time.
2. Interfering directly with the low-level library libart.so, specifically the art::hiddenapi::ShouldDenyAccessToMember function.

In an actual test by Ovi researcher on a Google Pixel 10 Pro device running Android 17 development build (API 37), the latest uCreator model (signed July 29, 2026) encountered a compatibility error and could not be activated.

The reason is that the Android development team changed the function signature in the ART source code, adding the Handlemirror::Class parameter, causing the C++ symbol name resolution process to change (name mangling). The old Pine source code integrated in uCreator searched for symbols according to the old string pattern, so it failed to locate the control function.

In-App Local Command Server

Instead of maintaining a cumbersome polling loop like traditional RAT malware, uCreator deploys a microservices architecture right inside the victim application. The malicious code initializes a local HTTP server via a library package:

com.ucreator.syncsocketlib.server.http

This server integrates a dispatch register table (HandlerRegistry), managing about 40 handlers classified by function numbers. An attacker via a Redis channel or forwarding proxy can send HTTP requests carrying JSON format data; The internal server will receive and execute right in the process context.

Each handler is declared as an Enum object that inherits the HttpHandler interface. When the handleRequest function receives a command, it will parse the parameters, initialize the corresponding business object (*_UcRequest), execute the command, and serialize the results back directly to the HTTP response content.

Stealing Telegram 2FA & Interfering with SQLite Database via Reflection

The Telegram intervention module (decompiled package com.ucreator.tgjar) reveals a deep understanding of the internal architecture of the Telegram Android Client:

1. Stealing 2FA passwords in cloud computing (Cloud Password)

Telegram's two-step authentication protocol uses the SRP (Secure Remote Password Protocol) algorithm to ensure user passwords are never sent over the network in plaintext. However, uCreator does not attempt to decode on the fly but places the hook directly in the function:

org.telegram.messenger.SRPHelper.getX(byte[] passwordBytes, byte[] salt, byte[] g)

This is Telegram's internal function called to calculate the mathematical proof for 2FA passwords. By hooking this function, the malware directly takes the password parameter in cleartext right before it is hashed and fed into the SRP algorithm. The password is then silently recorded in the application's SharedPreferences in preparation for transfer to the C2 server.

2. Hijack session & Evict root user

Through a set of reflection middleware layers (reflect.mirror.org.telegram.), the malware accesses Telegram's TL_account_ API surface to:

• List and destroy the victim's other login sessions (TL_account_resetAuthorization).
• Change or confirm the phone number associated with the account.
• Enable user locking business classes such as Uc_Business_RefuseLogin and Uc_Business_Frozen to push the victim's session out of the application while keeping the attacker's session alive.

3. Execute the SQL query directly into the cache4.db database

Handler code 101 (Db_MessagesStorageRawQuery) receives a plain SQL query string from the control server with absolutely no command filtering whitelist (whitelist). The isParamLegal() test method only checks whether the string is empty or not and compares the number of question marks ? with selectionArgs array.

Through the RequestHelper class, the malicious code directly holds the handle to the MessagesStorage.database object, directly calling the low-level functions queryFinalized, byteBufferValue and TLdeserialize. This is the same pipe that Telegram itself uses to read the internal database file cache4.db. All end-to-end encrypted or locally saved messages while open during a session are completely extracted.

WeChat Subsystem (va_vx): Identity Collection & Account Cloning Process

In contrast to the Telegram subsystem, which focuses on deeply intervening in local chat history, the WeChat attack subsystem (containing * va_vx identifiers) pursues the ultimate goal: Complete account takeover (Account Cloning).

The malware sample runs WeChat inside an independent virtualized sandbox based on VirtualApp. The attack process takes place in 4 steps:

• Get Tokens
• Packing
• Exfiltration
• Clone

In the analyzed sample, researchers found no signs of malicious code decrypting WeChat's WCDB/SQLCipher encrypted database. This proves that the attacker does not need to secretly read messages on the victim's machine; They just need to steal the entire identity cache and authentication data, send it to the cloud-phone infrastructure to log in to a completely identical WeChat session with the victim. Along with that, the contacts.vcf export script file will clean up the contact list to serve the next impersonation scam scenarios.

C2 Server Source Code Leak Analysis: Spring Cloud Architecture & 'Nick Maintenance' Mechanism

The biggest breakthrough in Ovi and Jurre's investigation came from the discovery that a GitLab server of the development team was misconfigured, exposed to the public Internet while other C2 server infrastructures had firewalls set up that only allowed IP whitelists.

The backend system is a massive swarm of microservices running on Spring Cloud:

• Command data flow: When the administrator issues an order on the web interface, a REST request is generated with the merchant_id. Commands are pushed to the Apache Kafka cluster, then a bridge service forwards to Apache RocketMQ. Here, the system automatically classifies tasks for personal WeChat or business WeCom accounts, and assigns delay timers.
• Distribution infrastructure: Commands from RocketMQ cross the trust boundary to transmit to infected mobile devices or cloud-phone clusters located in Changsha city.
• 'Account Cultivation' (养号 - Account Cultivation) mechanism: The development team has integrated a configuration coordination system based on Alibaba Nacos and Redis. This system imposes hourly activity windows, daily random interaction quotas, and behavioral budgets for each hijacked account. By regulating friend-making speed, message sending frequency and query time interval, this network makes malicious traffic look exactly like the hand-clicking behavior of a real person, thereby bypassing Tencent or Telegram's automatic risk control and anomaly detection systems.

Network Infrastructure and Trace

Network Infrastructure and C2 Streams

uCreator's infrastructure is arranged according to a multi-layer layered model combining major cloud providers in China:

• Control core: Located mainly on Alibaba Cloud (Aliyun) and Huawei Cloud, attached to the main domains qianxuncc.cn, videoflow.cn, and ops*.cn proxy servers. In the front is the Tengine Gateway reverse gateway and cloud telephony control server infrastructure written in .NET Ocelot, incorporating nodes that broadcast SRS/RTMP real-time video streams.
• Control Channel & Storage: Uses 3 distributed Redis clusters and 2 MQTT endpoints to maintain two-way connectivity to the device. The two main Aliyun OSS repositories are kfpt (containing hook updates and stolen data) and ops-yunguan.
• Dynamic C2 resolution mechanism: Mobile devices are not fixed to a single C2 domain. On startup, it reads the Redis Domain:Basics key to get the latest callback server address, caches it, and only uses the hardcoded address as a backup. When distributed domains such as qianxunlbs.com or uzyzx.com are flagged for deactivation by authorities or the security community (NXDOMAIN), the core server still operates safely.

Traces

1. Hunan Youchuang Technology Co., Ltd. (湖南由创科技有限公司 - Hunan Youchuang Technology Co., Ltd.): Affiliated with the brand ucreater.com and namespace com.ucreator.*. The self-signed TLS digital certificate found on the C2 server videoflow.cn carries a clear organization identifier field: O=湖南由创科技有限责任公司.
2. Changsha Sukai Network Co., Ltd. (长沙速凯网络有限责任公司 - Changsha Sukai Network Co., Ltd.): The enterprise that registered the official Chinese government network license (ICP) for the core C2 server domain name qianxuncc.cn.
3. Changsha Zhuoqing E-commerce Co., Ltd. (长沙卓擎电子商务有限公司 - Changsha Zhuoqing E-commerce Co., Ltd.): The entity that digitally signs the DigiCert Authenticode certificate on the Windows console executable file uip.exe.

Technical Matrix MITER ATT&CK Mapping

Tactic	Technique ID	Technique Name	Observed uCreator Behavior
Initial Access	T1476	Deliver Malicious App via Other Means	Distributes repackaged APKs through sideloading and a spoofed website, telegram-apk.uzyzx[.]com
Execution	T1646	User Execution	Tricks users into installing trojanized Telegram/WeChat builds and granting them permissions
Persistence	T1402	Component Hijacking	Uses VirtualApp and LSPatch to keep control over the application lifecycle
Defense Evasion	T1444	Masquerade as Legitimate Application	Keeps the original APK in the cache directory and spoofs the official app icon and name
Defense Evasion	T1406	Obfuscated Files or Information	Downloads the binary hook payload TgJarPine.dex at runtime from MinIO and Aliyun OSS
Credential Access	T1417	Input Capture	Hooks SRPHelper.getX to steal cleartext 2FA passwords and extracts WeChat login tokens
Credential Access	T1539	Steal Web Session Cookie	Extracts session tokens, cookies, and cached account authentication data
Discovery	T1418	Application Discovery	Enumerates installed applications on the device through the Get_Packages command
Discovery	T1430	Location Tracking	Collects the device's geolocation and network address information
Collection	T1432	Access Contact List	Harvests the victim's entire contact list through the Get_Phone_Contacts handler and the contacts.vcf file
Collection	T1412	Capture SMS Messages	Covertly reads SMS messages and OTPs through the Sms_ReadSmsLatest handler
Collection	T1533	Data from Local System	Directly queries the local SQLite database (cache4.db) through handler code 101
Command & Control	T1437	Application Layer Protocol	Communicates with servers using signed JSON REST APIs over HTTPS, Redis Pub/Sub, and MQTT
Command & Control	T1584.005	Dynamic DNS / Redis Bus	Resolves C2 domains dynamically through the Redis key Domain:Basics
Exfiltration	T1041	Exfiltration Over C2 Channel	Compresses application data and uploads it to Aliyun OSS cloud object storage

IOCs

File Hash

• 2fc4bad71eda25b9022ea7cb090d6419911ecd67e50e746b418f8a617a980301
• 0142749a159be3e41d28f910eebf28b577a282880bd0c2383bd7404189f4ff94
• dcec9640271a782553599197bcb85367971a5bb4aa84c3787d1e49a3f4f9420e
• 805834e6b8c12e180117a1816b48e387c33b53520f5a91cbf858441dc895e717
• a90e3ab2b5cf306439a378faf7107a89196116ad7ee4ad5791c2ba8839ba21c4
• f82ac2c525d1ed82e57b3f27ae689aeda46875a893ca4c42876b3166ba66bb20
• 99c5be579d218acfd2c7e2662528e7ad32a1a605d8efd1da732c13931bc30c4c
• 9c8b147f76312e651faabb1411a3270efca984dd8f33bd8ded3ea611c7c583a1

Malicious Domain

• videoflow[.]cn
• hw.android.videoflow[.]cn
• hpncallback.gold5play[.]com
• hpncallback.qianxunlbs[.]com
• telegram-apk.uzyzx[.]com
• s5.ips5[.]cn
• kfpt.oss-cn-hangzhou.aliyuncs[.]com
• paas.minio.opsapi[.]cn
• r-bp1jehsclgbuu48m7tpd.redis.rds.aliyuncs[.]com

IP

• 121.37.194[.]194
• 43.225.141[.]209
• 159.138.237[.]10
• 159.138.229[.]12

URL

• s5.ips5[.]cn/api/socks5/getGlobalS5Resource
• kfpt.oss-cn-hangzhou.aliyuncs[.]com/android/app/YingGai/
• paas.minio.opsapi[.]cn/fengzhuang-app/

Expert Comments FPT IS SOC

Paradigm shift: From OS exploitation to User-Space exploitation

Previously, high-level spyware (like Pegasus or Predator) relied on complex zero-day chains to escape the operating system's sandbox and escalate to root privileges. uCreator demonstrates that an attacker without needing to root a device can gain control equivalent to nation-state spyware. By repackaging or manipulating the user to run the target application in a virtualized container (LSPatch/VirtualApp), the malicious code resides in the same user-space, directly reading the decrypted memory and manipulating the application's live database.

Direct threat to the OTT & Fintech ecosystem in Vietnam

In the list of target applications that the uCreator source code supports, besides WeChat and Telegram, the research team identified the presence of Zalo and MoMo - the two messaging and digital payment applications with the largest market share in Vietnam, besides GCash, LINE, KakaoTalk and Viber. The fact that the malware integrates a module to fake the front camera data stream shows that the clear goal is to pass liveness checks in the banking eKYC process. This is an extremely dangerous link, which can lead to the opening of mass junk bank accounts or the authentication of unauthorized money transfers on the victim's device.

Industrialized Crimeware Standards

The combination of Spring Cloud, Kafka, RocketMQ and the 'Nguyen Nick' (养号) management system reflects the professional organization level of underground malware development teams. The attacker does not operate manually but applies enterprise software engineering methods: regulating traffic according to quotas, simulating natural user behavior to avoid having the account locked by the platform's anti-fraud system (Fraud Detection).

Defense Recommendations

For Individual Users & Employees

• Golden rule: Absolutely do not install APKs from unofficial sources. Only install apps from the Google Play Store. Disable the "Install Unknown Apps" feature in device settings.
• Be careful with "Mod", "Feature unlocked version", "Message protection version": This is the most common channel for criminals to trick users into installing repackaged versions containing LSPatch.
• Check the list of login versions regularly: In the Telegram application (Settings -> Devices) or Zalo/WeChat, periodically check for strange devices that are maintaining active sessions. If you detect unusual signs, immediately select "Terminate all other sessions" and change your account password.
• Enable Google Play Protect: Make sure Play Protect is always on to periodically scan binaries with runtime hook behavior.

For Business Admins & SOC Teams

Urgent Recommendation (Immediate: 0 – 24 hours)

• Network Block & Hunt: Brings the entire list of C2 domains (*.videoflow.cn, *.qianxuncc.cn, .gold5play.com, .qianxunlbs.com, .uzyzx.com) and IP addresses (121.37.194.194, 43.225.141.209, 159.138.237.10, 159.138.229.12) to the block list on firewall systems (Next-Gen Firewall), Secure Web Gateway (SWG) and DNS Sinkhole.
• Trace enterprise mobile devices: Use EMM/MDM solution to scan for the existence of specific paths: /data/data//cache/lspatch/origin/ or detect installation packages com.ucreator., com.uckj.

Short-term recommendation (Short-term: 1 – 7 days)

• BYOD Policy & Mobile Device Management: Absolutely prohibit the use of devices that have been tampered with, loaded with custom roms or that allow sideloading to access email systems and corporate intranets.
• Monitor unusual traffic from Wi-Fi network partition: Set up warning rules on the NDR/SIEM system for TCP connections out strange ports (65531, 32115, 26379) pointing to public cloud infrastructure (Aliyun/Huawei Cloud).

Long Term Recommendations for Mobile App Developers

• Implement anti-virtualization techniques (Anti-Virtualization & Anti-Dual-Open): The application needs to integrate code that checks whether it is executing inside a virtualized space such as VirtualApp, DualSpace or ParallelSpace (check the private data path, check the RunningAppProcessInfo list).
• Anti-Hooking Detection: Checks for the presence of common hook libraries in memory (XposedBridge, Pine, Frida, LSPosed) through reading the /proc/self/maps file.
• APK Signature Integrity Constraint (Signature Verification): Performs a cross-check of the APK packaged certificate signature at runtime with a hash value securely stored on the server to instantly detect if the app has been unpacked and repackaged using LSPatch.

References

uCreator Android Spyware Steals Telegram 2FA & Clones WeChat | Aviatrix Threat Research

Researchers Uncover Rentable Android Spyware uCreater Targeting WeChat and Telegram

uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps