Inside a Packed Android RAT Loader
Source AlienVault OTX General
Description
Hagaseca is an Android malware cluster that targets devices with exposed Android Debug Bridge (ADB) services, particularly focusing on the THost9 RAT loader variant. It uses a packed APK to load a secondary stage (tc9.dex) that provides remote shell access, file transfer, and propagation capabilities. The malware abuses accessibility features for device control and establishes persistence via foreground services. It spreads opportunistically by scanning networks for exposed ADB endpoints, especially affecting Redroid container deployments and devices with public ADB over Wi-Fi. The malware exhibits worm-like behavior by authenticating with prepared keys and installing itself on vulnerable systems.
Impact
The malware enables remote control of infected Android devices, including shell access and file transfer capabilities. It can propagate autonomously by scanning for and exploiting exposed ADB services, potentially leading to widespread compromise of vulnerable devices. The abuse of accessibility features allows for enhanced device control and persistence. Devices running Redroid containers or those with publicly exposed ADB over Wi-Fi are especially at risk. This can result in unauthorized access, data exfiltration, and further malware spread within networks.
Defensive guidance
No vendor advisory or patch information is provided. Mitigation should focus on securing Android Debug Bridge (ADB) services by disabling public exposure of ADB over networks, especially Wi-Fi. Restrict network access to ADB ports and disable ADB when not in use. Monitor for unauthorized accessibility feature usage and foreground services indicative of persistence mechanisms. Since no official patch or fix is mentioned, organizations should apply network segmentation and hardening to prevent exposure of ADB services to the internet.
Indicators of compromise
Domains 4
- hagaseca.com
- hagaseca.ec
- hagaseca.pleasedonthackmyserver.com
- test.hagaseca.com
URLs 3
- https://api.ipapi.is
- http://hagaseca.pleasedonthackmyserver.com/hagaseca/gta
- https://test.hagaseca.com/ws
IP addresses 1
- 79.110.49.156