Inside a Packed Android RAT Loader
Hagaseca is an Android malware cluster linked to exposed Android Debug Bridge (ADB) services, focusing on the THost9 RAT loader variant. The malware conceals executable code within an APK that loads tc9.dex, a stage providing shell access, file transfer, and ADB propagation capabilities. Public incidents connect THost4 and THost9 to exposed Android and Redroid systems from October 2024 through 2026. The loader uses XOR and gzip packing, establishes persistence through foreground services, exploits accessibility features for device control, and downloads additional stages from test.hagaseca.com. The tc9.dex stage implements remote administration, discovers ADB endpoints via mDNS, scans entire /16 networks, authenticates with prepared keys, and installs itself on vulnerable systems. The malware exhibits worm-like behavior, spreading opportunistically through unsecured ADB services exposed to the internet, particularly affecting Redroid container deployments and devices with public ADB over Wi-Fi.
AI Analysis
Technical Summary
Hagaseca is an Android malware cluster leveraging exposed Android Debug Bridge (ADB) services to propagate and maintain persistence. The THost9 RAT loader conceals its executable code within an APK that loads the tc9.dex stage, enabling shell access, file transfer, and ADB-based propagation. The malware uses XOR and gzip packing to evade detection and establishes persistence via foreground services and abuse of accessibility features. It downloads additional payloads from a command-and-control domain (test.hagaseca.com). The tc9.dex stage performs network discovery of ADB endpoints using mDNS, scans entire /16 networks, authenticates with prepared keys, and installs itself on vulnerable devices. This worm-like behavior allows it to spread through unsecured ADB services exposed to the internet, with a notable impact on Redroid container environments and devices with publicly accessible ADB over Wi-Fi.
Potential Impact
The malware enables remote administration of infected Android devices, including shell access and file transfer capabilities. It can propagate autonomously by scanning for and exploiting exposed ADB services, potentially leading to widespread compromise of vulnerable devices. Persistence mechanisms and accessibility abuse increase the difficulty of detection and removal. The worm-like propagation behavior poses a risk of rapid spread within networks that have unsecured ADB endpoints, particularly affecting Redroid container deployments and devices with public ADB exposure.
Mitigation Recommendations
No official patch or fix is indicated in the provided data. Mitigation should focus on securing Android devices by disabling or restricting ADB access, especially over Wi-Fi or public networks. Network administrators should ensure that ADB services are not exposed to the internet and that strong authentication controls are in place. Monitoring for unauthorized foreground services and accessibility abuse may help detect infections. Since this malware exploits exposed ADB services, eliminating such exposure is the primary defense. Patch status is not yet confirmed — check vendor advisories and security bulletins for updates.
Indicators of Compromise
- url: https://api.ipapi.is
- domain: hagaseca.com
- hash: bdca0eb738faaccb5b992d0f393b9d9f
- hash: c6ee3d72053772bdce063c5b98afe32e739e918e
- hash: 54d4ee85175a249dcb576716edf491d09fa05dfdfc492ff710a0cb711f9a35ab
- hash: 24f344e174546e780332d573d5a27c43
- hash: dfd9c7dee4f4a16d636917de35a510b7
- hash: 03fc9c35d6453ccf7dd5d16ea2d6d272da1e1cae
- hash: 3a8138debf528361bf7093e3aa85a5f84105ebf6
- hash: 05e26b639f55e53f73c2fd2980c519db347086951d832d58a94a26990d81befe
- hash: 12fb8fe6cd895044e38217dd5945b0ec810f667660fd87dbb21687ea42084589
- hash: 16c3ee7276d52c11d3cc6270af883abe5d7015ea4f8f66fb3b6493144a863377
- hash: 1e6ff4a1dba4d6e4c29f4f7bc06b774104a38c181a05ebed127bb7b914128a21
- hash: 30f4e1bc0cd96d4210765b18533eb0c5343f155a36b1a567132538242487d09c
- hash: 45f71eb7ee96f80a1e865b2249452b603b729f4fc4c6f02ed00cadcdacf8f384
- hash: 5652e2256df133a429f329ba60fe78c67ce63e089a5a3d58e4ff3d058ef7a708
- hash: 7ec965cd61ad4de270b45e7719fdd72b3a37b27c0ba5764a73ec2c1cfc966559
- hash: 9cd3a954e807a3d596401b43e8820ca6ee76119d4dfc60afe0eaaf054e2c2ab5
- hash: b32bfa02834d43f04b78854e6cc417da2d45a2ca6d2908f33c06dc97c7cc0389
- hash: dfd708b9debd3c32897b96726a5a9437bcb36f1ad59639f1214a969f8f09e237
- ip: 79.110.49.156
- url: http://hagaseca.pleasedonthackmyserver.com/hagaseca/gta
- url: https://test.hagaseca.com/ws
- hash: 8e2a4186103443e05f57d6607969ebba953a16f4
- hash: 962add498857e2497bb9b720528cc6a687a5db07
- domain: hagaseca.ec
- domain: hagaseca.pleasedonthackmyserver.com
- domain: test.hagaseca.com
Inside a Packed Android RAT Loader
Description
Hagaseca is an Android malware cluster linked to exposed Android Debug Bridge (ADB) services, focusing on the THost9 RAT loader variant. The malware conceals executable code within an APK that loads tc9.dex, a stage providing shell access, file transfer, and ADB propagation capabilities. Public incidents connect THost4 and THost9 to exposed Android and Redroid systems from October 2024 through 2026. The loader uses XOR and gzip packing, establishes persistence through foreground services, exploits accessibility features for device control, and downloads additional stages from test.hagaseca.com. The tc9.dex stage implements remote administration, discovers ADB endpoints via mDNS, scans entire /16 networks, authenticates with prepared keys, and installs itself on vulnerable systems. The malware exhibits worm-like behavior, spreading opportunistically through unsecured ADB services exposed to the internet, particularly affecting Redroid container deployments and devices with public ADB over Wi-Fi.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Hagaseca is an Android malware cluster leveraging exposed Android Debug Bridge (ADB) services to propagate and maintain persistence. The THost9 RAT loader conceals its executable code within an APK that loads the tc9.dex stage, enabling shell access, file transfer, and ADB-based propagation. The malware uses XOR and gzip packing to evade detection and establishes persistence via foreground services and abuse of accessibility features. It downloads additional payloads from a command-and-control domain (test.hagaseca.com). The tc9.dex stage performs network discovery of ADB endpoints using mDNS, scans entire /16 networks, authenticates with prepared keys, and installs itself on vulnerable devices. This worm-like behavior allows it to spread through unsecured ADB services exposed to the internet, with a notable impact on Redroid container environments and devices with publicly accessible ADB over Wi-Fi.
Potential Impact
The malware enables remote administration of infected Android devices, including shell access and file transfer capabilities. It can propagate autonomously by scanning for and exploiting exposed ADB services, potentially leading to widespread compromise of vulnerable devices. Persistence mechanisms and accessibility abuse increase the difficulty of detection and removal. The worm-like propagation behavior poses a risk of rapid spread within networks that have unsecured ADB endpoints, particularly affecting Redroid container deployments and devices with public ADB exposure.
Defensive Guidance
No official patch or fix is indicated in the provided data. Mitigation should focus on securing Android devices by disabling or restricting ADB access, especially over Wi-Fi or public networks. Network administrators should ensure that ADB services are not exposed to the internet and that strong authentication controls are in place. Monitoring for unauthorized foreground services and accessibility abuse may help detect infections. Since this malware exploits exposed ADB services, eliminating such exposure is the primary defense. Patch status is not yet confirmed — check vendor advisories and security bulletins for updates.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader"]
- Adversary
- null
- Pulse Id
- 6aa03edd0fe4e4f76a331977
- Threat Score
- null
Indicators of Compromise
Url
| Value | Description | Copy |
|---|---|---|
urlhttps://api.ipapi.is | — | |
urlhttp://hagaseca.pleasedonthackmyserver.com/hagaseca/gta | — | |
urlhttps://test.hagaseca.com/ws | — |
Domain
| Value | Description | Copy |
|---|---|---|
domainhagaseca.com | — | |
domainhagaseca.ec | — | |
domainhagaseca.pleasedonthackmyserver.com | — | |
domaintest.hagaseca.com | — |
Hash
| Value | Description | Copy |
|---|---|---|
hashbdca0eb738faaccb5b992d0f393b9d9f | — | |
hashc6ee3d72053772bdce063c5b98afe32e739e918e | — | |
hash54d4ee85175a249dcb576716edf491d09fa05dfdfc492ff710a0cb711f9a35ab | — | |
hash24f344e174546e780332d573d5a27c43 | — | |
hashdfd9c7dee4f4a16d636917de35a510b7 | — | |
hash03fc9c35d6453ccf7dd5d16ea2d6d272da1e1cae | — | |
hash3a8138debf528361bf7093e3aa85a5f84105ebf6 | — | |
hash05e26b639f55e53f73c2fd2980c519db347086951d832d58a94a26990d81befe | — | |
hash12fb8fe6cd895044e38217dd5945b0ec810f667660fd87dbb21687ea42084589 | — | |
hash16c3ee7276d52c11d3cc6270af883abe5d7015ea4f8f66fb3b6493144a863377 | — | |
hash1e6ff4a1dba4d6e4c29f4f7bc06b774104a38c181a05ebed127bb7b914128a21 | — | |
hash30f4e1bc0cd96d4210765b18533eb0c5343f155a36b1a567132538242487d09c | — | |
hash45f71eb7ee96f80a1e865b2249452b603b729f4fc4c6f02ed00cadcdacf8f384 | — | |
hash5652e2256df133a429f329ba60fe78c67ce63e089a5a3d58e4ff3d058ef7a708 | — | |
hash7ec965cd61ad4de270b45e7719fdd72b3a37b27c0ba5764a73ec2c1cfc966559 | — | |
hash9cd3a954e807a3d596401b43e8820ca6ee76119d4dfc60afe0eaaf054e2c2ab5 | — | |
hashb32bfa02834d43f04b78854e6cc417da2d45a2ca6d2908f33c06dc97c7cc0389 | — | |
hashdfd708b9debd3c32897b96726a5a9437bcb36f1ad59639f1214a969f8f09e237 | — | |
hash8e2a4186103443e05f57d6607969ebba953a16f4 | — | |
hash962add498857e2497bb9b720528cc6a687a5db07 | — |
Ip
| Value | Description | Copy |
|---|---|---|
ip79.110.49.156 | — |
Threat ID: 6aa11e44acd9273b490bdfd6
Added to database: 09/09/2026, 08:52:20 UTC
Last enriched: 09/09/2026, 09:08:18 UTC
Last updated: 09/09/2026, 21:39:35 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.