Hagaseca: Inside a Packed Android RAT Loader

Executive summary

Hagaseca is an Android malware cluster associated with exposed Android Debug Bridge (ADB) services. This analysis examines the Hagaseca Android RAT loader known as THost9. RAT stands for remote access trojan. A RAT can let an attacker control an infected device remotely.

The loader hides executable code inside an Android application package (APK). It then loads tc9.dex, a separate stage with shell access, file transfer, and ADB propagation capabilities.

Public incident reports link THost4 and THost9 to exposed Android and Redroid systems. Redroid runs Android in containers. The recovered code helps explain those reports, but scanning an ADB service does not automatically grant access.

Hagaseca is an artifact-based cluster name. The available evidence does not establish a verified threat-group identity.

Key findings

• Packed loader: THost9 decodes an embedded asset and loads Android bytecode, known as DEX.
• Remote control: The recovered tc9.dex stage supports shell commands, file transfer, tunneling, and additional modules.
• ADB propagation: The stage discovers and scans ADB endpoints. Installation depends on usable access and the available privileges.
• Device control: The loader uses foreground services and Android accessibility features. In one tested build, a reachable local socket accepted commands without authentication.
• Detection opportunities: Package names, signing information, stage files, and network markers help identify the examined samples.

What Is Hagaseca THost9?

Hagaseca and THost9 refer to different levels of the same investigation.

• Hagaseca cluster means the wider artifact-defined set connected through namespaces, infrastructure, signing identity, and repeated implementation choices.
• THost9 means the Android chain using package com.hagaseca.thost9 and downstream class com.hagaseca.tc9.Main.
• THost9 implementations means the verified loader builds, their embedded DEX files, and the recovered tc9.dex stage used here to document the family’s design.

The component boundary matters. The APK loader implements packing, concealment, accessibility control, foreground persistence, and stage loading. tc9.dex implements the remote RAT channel, ADB worm, installer, and downloadable-module system.

The family name is unusually explicit. The builds use the Hagaseca namespace, the certificate common name is hagaseca, the manifests contain gainhoney7372@gmail.com, and the recovered stage defines com.hagaseca.tc9.Main. Together, these identifiers establish a consistent family label across the recovered chain.

Hagaseca Timeline: THost4 to THost9

The located public record spans THost4 submissions in 2024 and THost9 artifacts and incident reports in 2025–2026. The timeline below distinguishes registration, submission, certificate, and incident dates.
A domain registration or certificate validity date does not establish when an attack began. Registration of a parent domain also does not prove when its Hagaseca subdomain was created.

Date	Milestone
16 March 2024	pleasedonthackmyserver.com is registered; THost4 later uses its Hagaseca subdomain
28 October 2024	Triage records the earliest located public THost4 submission
13 May 2025	Verisign RDAP records the dedicated hagaseca.com domain
24 June 2025	A Redroid incident identifies com.hagaseca.thost4 in persistent /data
3 August 2025	The THost9 signing certificate’s validity begins; this is not necessarily its first deployment date
26 December 2025	Triage records a third THost9 artifact with the same signing identity
19 January 2026	A public-ADB phone owner reports THost9 and port-5555 interference
9 March 2026	An archived user names the exact THost9 package and reports a blank notification matching its foreground-service design
March to April 2026	Phone and Redroid users report ADB recovery after THost9 removal
April 2026	The matching tc9.dex stage shares the THost9 sample date and links the RAT command surface, ADB propagation, and installer to the loader
21 April 2026	A recovery record stops THost9 and restores service.adb.tcp.port from 5554
22 July 2026	A project changes Redroid ADB publishing from public to localhost-only after a THost9 incident

THost4 is the earliest Hagaseca-named THost artifact located, followed by signed THost9 artifacts and exposed-ADB incidents documented through 2026.

Reported ADB Incidents and Device Impact

Public ADB exposure is the distribution pattern established by the recovered code and multiple incident records.

The redroid-doc incident thread first identifies THost4 in a compromised persistent /data volume. Later reports describe THost9 on a phone with public ADB over Wi-Fi and in Redroid environments whose Docker ADB ports were exposed. A July remediation commit changes the mapping from 0.0.0.0:5555 to 127.0.0.1:5555 after a documented infection.

The recovered tc9.dex confirms opportunistic scanning and installation through unsecured or previously authorized ADB. It discovers _adb-tls-connect._tcp, _adb-tls-pairing._tcp, and _adb._tcp, expands an operator-selected address to a /16, probes 65,025 hosts, authenticates with prepared ADB key material, retrieves thost9.apk, and runs its embedded installer. The same stage can set service.adb.tcp.port to 5554 and toggle Android’s ADB settings.

Device Impact Reported by Users

Environment	Reported behavior
Redroid Android containers	Reports associate THost4/9 with Internet-exposed ADB and persistence in /data
Physical Android phones	Users report THost9 disrupting ADB/USB debugging and removal restoring access
Unspecified Android device	An archived user names com.hagaseca.thost9 and reports a blank notification matching the foreground-service code

The targeting rule is exposure driven: the recovered scanner expands a selected address to a /16 and tests every generated host on the chosen ADB port.

Reported Blank Notification

An archived post dated 9 March 2026 names com.hagaseca.thost9 and describes a blank notification. That symptom is consistent with the loader’s nearly empty foreground-service notification.

A blank notification alone does not identify THost9. Confirm the package, signer, and related artifacts before drawing that conclusion.

Loader Execution Chain

The recovered execution chain has twelve major steps:

1. Android instantiates com.hagaseca.loader.Main as the application object.
2. The outer loader reads assets/hg and treats its first byte as a one-byte XOR key.
3. XOR decoding reveals a gzip stream that expands to a valid DEX payload.
4. The original wrapper is cached privately as .hg.db.
5. The loader injects the recovered DEX at the front of the application class path.
6. The payload removes its task from Recents, moves the activity behind the current UI, and starts background components.
7. A foreground service posts a visually blank notification and enters a staging loop.
8. If protected secure-settings access already exists, the payload enables com.hagaseca.thost9/.AS as an accessibility service.
9. The loader requests tc9.dex from https://test.hagaseca.com/ws, caches a valid stage as .tc9, and invokes com.hagaseca.tc9.Main.main(String[]).
10. The stage establishes its own C2 session and exposes shell, file-transfer, tunnel, reverse-shell, settings/ADB, and module commands.
11. Its worm worker discovers or scans ADB endpoints, authenticates, downloads thost9.apk, and runs the installer.
12. A boot receiver, service self-recovery, and a stage alarm maintain execution.

The component boundary is clear: the APK loader implements packing, concealment, accessibility, and stage loading; tc9.dex implements the remote RAT channel, ADB worm, and installer.

Cryptographic and Staging Protocol

THost9 uses two different mechanisms: packing to conceal embedded code, and an encrypted stream to exchange stage data. XOR and gzip form the packing layer; they should not be described as strong encryption.

The stage channel reads a 16-byte value and uses it as both the AES key and counter-mode initialization vector (IV). It then reads length-prefixed data and checks the expected stage hash.

The inner stream has no message authentication code (MAC). It lacks independent protection against modification if the outer TLS protection is defeated. A stage-hash check is not equivalent to authenticating the channel. These design weaknesses do not, by themselves, prove interception occurred.

Layer	Construction	Security observation
Embedded assets/hg	First byte is XOR key, remaining bytes XOR-decoded, then gzip decompressed	Packing layer; S1 key 0x1c, S2 key 0xa5
Outer transport	HTTPS with a custom HTTP/1.0 upgrade	S2 contains a trust-all X509 manager on one IPv4-resolved branch
Inner stream	AES/CTR/NoPadding, 128-bit value reused as key and IV	Cryptographically weak design; no application-layer MAC
Frame layer	Four-byte big-endian signed length	Negative/complemented lengths select an additional transform
Optional stage wrapper	One-byte XOR followed by gzip	Same general packing concept as the embedded asset

Sample Metadata

The following representative loader implementations show the version-level differences used throughout this analysis.

Property	Loader implementation S1	Loader implementation S2
Original filename	7ec965cd61ad4de270b45e7719fdd72b3a37b27c0ba5764a73ec2c1cfc966559	_null.apk
Size	33,489 bytes	41,681 bytes
MD5	24f344e174546e780332d573d5a27c43	dfd9c7dee4f4a16d636917de35a510b7
SHA-1	03fc9c35d6453ccf7dd5d16ea2d6d272da1e1cae	3a8138debf528361bf7093e3aa85a5f84105ebf6
SHA-256	7ec965cd61ad4de270b45e7719fdd72b3a37b27c0ba5764a73ec2c1cfc966559	30f4e1bc0cd96d4210765b18533eb0c5343f155a36b1a567132538242487d09c
Package	com.hagaseca.thost9	com.hagaseca.thost9
DEX version	Outer and embedded DEX 039	Outer and embedded DEX 037
Whole-file entropy	7.476338 bits/byte	7.620410 bits/byte
Embedded DEX SHA-256	05e26b639f55e53f73c2fd2980c519db347086951d832d58a94a26990d81befe	9cd3a954e807a3d596401b43e8820ca6ee76119d4dfc60afe0eaaf054e2c2ab5

The examined builds use v1, v2, and v3 signing with the same self-signed 256-bit EC certificate. Its SHA-256 fingerprint is:

b32bfa02834d43f04b78854e6cc417da2d45a2ca6d2908f33c06dc97c7cc0389

The certificate subject and issuer are both CN=hagaseca.

The recovered tc9.dex is a 127,108-byte DEX 037 file with SHA-256 54d4ee85175a249dcb576716edf491d09fa05dfdfc492ff710a0cb711f9a35ab, SHA-1 c6ee3d72053772bdce063c5b98afe32e739e918e, and MD5 bdca0eb738faaccb5b992d0f393b9d9f. It defines 68 classes and the exact entry point selected by the verified loader implementations.

Command and Control Infrastructure

The following identifiers connect the examined loader and stage. Command and control (C2) is the communication channel used to receive instructions or retrieve additional code.

The manifest email is an embedded string, not a verified operator contact. The wildcard socket was observed in contained S1 testing; binding to all interfaces does not prove it was reachable from the public internet.

Channel	Observed implementation
C2 URL	https://test.hagaseca.com/ws, decoded across the embedded payload implementations
C2 host	test.hagaseca.com; S2 DNS attempts were observed in containment
Manifest email	gainhoney7372@gmail.com, embedded in the examined manifests
Local control	Wildcard TCP 64737, decrementing if occupied; the S1 listener was reached during contained testing
Downloaded stage	tc9.dex with entry class com.hagaseca.tc9.Main, matched directly to the loader contract
Stage headers	ts, user-agent, hg-hh, hg-token, and hg-type across loader and stage transports

Execution Architecture

THost9 separates a small stable loader from an expandable RAT/worm stage. The loader establishes persistence, starts the foreground service, profiles the device, exposes accessibility control, and launches tc9.dex; the stage adds remote administration, ADB propagation, installation, and another downloadable-module layer.

Component Roles and Triggers

Mode or component	Trigger	Behavior
Application loader	Package-process creation	Decodes assets/hg, caches .hg.db, and injects the payload DEX
Main activity	Explicit component launch or orchestration	Starts services, hides its task, and moves to the background
Boot receiver	BOOT_COMPLETED	Starts or binds .Fore
Foreground service	.Fore lifecycle	Maintains the blank notification, C2 retry, and stage hash/download/load loop
Accessibility service	Existing secure-settings grant or user/system enablement	Inspects and interacts with the Android UI
S1 local controller	Private start_as marker	Opens wildcard TCP 64737 downward and writes as_port
S2 local controller	Internal thread-state condition	Starts the accessibility command server
Downloaded-stage loader	Valid response or cached .tc9	Loads and invokes com.hagaseca.tc9.Main
Remote RAT	Active tc9.dex session	Provides shell, file transfer, tunnel, reverse shell, settings/ADB control, and modules
ADB worm	Operator target or mDNS-discovered service	Scans a /16, probes/authenticates to ADB, retrieves the APK, and runs the installer

This architecture gives defenders two different opportunities. The package and embedded loader offer durable static identifiers, while the accessibility service, persistent notification, local socket, and repeated C2 retries provide behavioral signals.

ADB Propagation and Remote Installation

THost9 contains an ADB propagation chain:

1. tc9.dex discovers ADB through mDNS or accepts an operator-selected IP:port.
2. Remote-scan mode expands the target to a /16 and probes 65,025 addresses with 50 workers.
3. A second pass sends a raw ADB CNXN frame and selects AUTH or CNXN responders.
4. The raw client authenticates using prepared Hagaseca ADB key material and opens a remote shell.
5. The stage downloads thost9.apk from its active C2.
6. The embedded installer performs a streamed replacement install and configures permissions, accessibility, services, and privileged persistence when available.
7. The installed APK unpacks its embedded payload, starts .Fore, and loads tc9.dex, allowing the cycle to continue against additional reachable ADB endpoints.

ADB Privileges and Infrastructure History

The installer uses direct root or su 0 when the remote ADB context provides privileged execution. The stage can set service.adb.tcp.port to 5554, invoke tcpip <port>, toggle adb_enabled and adb_wifi_enabled, open Wireless Debugging settings, and relay local ADB.

The infrastructure sequence moves from a THost4 Hagaseca subdomain on pleasedonthackmyserver.com to the dedicated hagaseca.com domain used by THost9.

Infrastructure	Role	Research snapshot
hagaseca.pleasedonthackmyserver.com	Historical THost4 host	Recorded in Triage telemetry; currently NXDOMAIN
http://hagaseca.pleasedonthackmyserver.com/hagaseca/gta	Historical THost4 poll	Observed with HTTP 404 responses
test.hagaseca.com	THost9 C2 hostname	Resolved to 79.110.49.156 on 4 September 2026
https://test.hagaseca.com/ws	THost9 stage endpoint	Hardcoded across the examined payloads
79.110.49.156	Collection-time A record	Shared-hosting pivot; route origin AS399486

A minimal analyst-side check on 3 September returned HTTP 101 after an empty WebSocket-style upgrade, confirming that the endpoint accepted the upgrade sequence used by the loader.

Device Profiling and File Transfer

The loader’s h109 and stage’s c210 profiles send Android version, CPU/ABI, memory, brand/product/model, an Android-ID prefix, ADB state/port, and network context in the user-agent header. The stage also implements pull:: to read an operator-selected file and transmit it over the active encrypted session, while push:: writes operator-supplied data to a selected path.

Technical Analysis

Loader and Command Channels

The outer loader is intentionally small. It extracts the XOR key from the first asset byte, decodes the remainder, inflates the gzip stream, and prepends the resulting DEX to the class path during application startup.

The remote stage channel is separate from the local accessibility controller:

1. Build GET /ws HTTP/1.0 for https://test.hagaseca.com/ws.
2. Add Connection: upgrade, Upgrade: websocket, and hg-token.
3. Add hg-type: kita for stage-hash queries and, in S2, the device profile as user-agent.
4. Require HTTP status 101.
5. Read 16 bytes and reuse the value as the AES-128 key and CTR IV.
6. Read a four-byte big-endian signed frame length.
7. Decode the body, validate the expected stage hash, cache .tc9, and invoke com.hagaseca.tc9.Main.main(String[]).

Accessibility-Based Device Control

The local controller belongs to the accessibility service. It opens a wildcard ServerSocket, begins at TCP 64737, and decrements the port if binding fails. S1 returned hg_as > immediately and answered harmless test input analysis with invalid cmd: analysis.

Command	Build	Action
n	Both	Open notifications
h	Both	Go Home
b	Both	Go Back
p	Both	Open power dialog
r	Both	Open Recents
qs	Both	Open Quick Settings
ls	Both	Return cached accessibility-node listing
lsf	Both	Refresh and return active-window nodes
cN	Both	Tap coordinates derived from indexed-node bounds
fN	S2	Focus an indexed node
zN	S2	Click an indexed node
set	Both	Open Android Settings
su / sd	Both	Scroll a scrollable child forward or backward

Why this matters: The local listener can provide immediate UI control without authentication if another process or reachable peer can access the bound port. The remote channel is modular, but its domain, stage names, custom headers, framing, and weak inner key construction provide strong hunting opportunities.

Defense Evasion

The examined implementations suppress ordinary launcher visibility. They use a blank label, provide no launcher intent, exclude the activity from Recents, move the task behind the current UI, and populate the foreground notification with spaces.

The real code is hidden inside assets/hg behind XOR and gzip. The loaders cache the original wrapper as .hg.db, inject the recovered DEX dynamically, encode strings as byte arrays, and rely heavily on reflection.

S2 adds a live anti-instrumentation guard. A thread scans /proc/self/maps for the byte string frida. If found, it prints HAGASECA: GOODNIGHT and calls Runtime.exit(0).

Why this matters: The embedded payload implementations were extracted completely and passed DEX checksum and SHA-1 integrity validation. The literal /proc/self/maps search, exit marker, packed asset, and private cache names provide observable detection points.

Persistence

The examined manifests register com.hagaseca.thost9.Boot for BOOT_COMPLETED. The receiver starts or binds .Fore, which promotes itself to a foreground service with the nearly blank notification.

S2 adds Keeper, Stager, monitor, guard, and accessibility-monitor threads. When .Fore was explicitly stopped during contained Android 9 testing, logcat recorded destruction, rebinding, recreation, and a new start command. The foreground service returned and resumed its contained C2 retry loop in about two seconds.

Android protects WRITE_SECURE_SETTINGS from ordinary third-party applications. During contained testing, accessibility activated after the analyst supplied the grant through ADB. The recovered installer includes a permission-grant path for execution from a privileged ADB shell.

Why this matters: THost9 recovers from ordinary service interruption once active, while unexpected accessibility enablement remains a high-value detection signal.

Device Profiling and Arbitrary Shell Execution

The loader’s shell helper executes sh -c. Its built-in callers collect OS, CPU, process-count, and memory values for the h109 profile. The tc9 dispatcher exposes the same primitive as an operator command, while the c210 profile adds Android version, ABI, memory, brand, product, model, an Android-ID prefix, ADB state and port, and network context

Capabilities of the tc9 RAT Stage

The supplied 127,108-byte DEX 037 file satisfies the exact stage contract implemented by the verified loaders. Its SHA-256 is 54d4ee85175a249dcb576716edf491d09fa05dfdfc492ff710a0cb711f9a35ab. It defines com.hagaseca.tc9.Main.main(String[]), and that method passes the loader-supplied C2 URL directly into the stage session controller.

Prefix	Implementation
sh::	Built-in commands and arbitrary sh -c fallback
lm::	Downloaded DEX/JAR module loading and invocation
push:: / pull::	Arbitrary file upload and download
tun::	Bidirectional TCP relay
rs::	Interactive reverse shell

The worm path discovers ADB through mDNS or scans an operator-selected /16. It uses 50 workers, a 500 ms connection pass, a 1,000 ms ADB probe pass, and the raw CNXN frame 434e584e01000001000010000600000032020000bcb1a7b1686f73743a3a. AUTH or CNXN responders are passed to a raw ADB client that implements CNXN, AUTH, STLS, OPEN, OKAY, WRTE, and CLSE.

The stage downloads thost9.apk, then executes a 1,843-byte embedded installer. That installer performs a streamed package install and, when privileged, writes /data/.hg/com.hagaseca.thost9/com.hagaseca.thost9.apk, links it into /system/app, grants the RAT’s required permissions, enables com.hagaseca.thost9/.AS, and starts .Fore.

The stage also schedules .Fore every 15 minutes, tracks active workers, persists module state under .mods, and profiles the host with marker c210.

Why Hagaseca Matters

• It is a multi-version cluster. Public THost4 and THost9 artifacts span October 2024 through 2026, and a third THost9 sample matches the local signer.
• The access route is preventable. Incident records and the recovered scanner directly connect infections with public ADB or Redroid exposure.
• The RAT is modular. tc9.dex adds a second layer of downloadable DEX/JAR modules without rebuilding the visible APK.
• ADB propagation is built into the stage. It discovers, scans, authenticates, downloads thost9.apk, and runs its installer.
• UI control is interactive. Once accessibility is active, the payload can inspect windows and inject navigation, taps, focus, clicks, and scrolling.
• Execution is deliberately unobtrusive. The blank label, hidden task, and nearly empty notification reduce casual discovery.
• S2 self-recovers. Its foreground service returned roughly two seconds after an explicit stop.
• The local controller is unauthenticated. S1 accepted commands through a wildcard TCP listener without a password or token.
• The protocol exposes durable signatures. The domain, stage name, custom headers, h109/c210 profiles, ADB probe, and cache filenames survive implementation changes.

Detection and Indicators of Compromise

Indicators of compromise (IOCs) help connect a suspected device to the examined samples. Use exact artifact matches and correlated behavior together; several network and file indicators also occur in legitimate activity.

File-Based Indicators

The following hashes identify files and signing material described in the supplied analysis. A matching file hash identifies that artifact; absence of a match does not exclude other builds.

Indicator	Type
7ec965cd61ad4de270b45e7719fdd72b3a37b27c0ba5764a73ec2c1cfc966559	S1 APK SHA-256
30f4e1bc0cd96d4210765b18533eb0c5343f155a36b1a567132538242487d09c	S2 APK SHA-256
05e26b639f55e53f73c2fd2980c519db347086951d832d58a94a26990d81befe	S1 embedded DEX SHA-256
9cd3a954e807a3d596401b43e8820ca6ee76119d4dfc60afe0eaaf054e2c2ab5	S2 embedded DEX SHA-256
1e6ff4a1dba4d6e4c29f4f7bc06b774104a38c181a05ebed127bb7b914128a21	S1 packed assets/hg SHA-256
16c3ee7276d52c11d3cc6270af883abe5d7015ea4f8f66fb3b6493144a863377	S2 packed assets/hg SHA-256
b32bfa02834d43f04b78854e6cc417da2d45a2ca6d2908f33c06dc97c7cc0389	Shared certificate SHA-256
dfd708b9debd3c32897b96726a5a9437bcb36f1ad59639f1214a969f8f09e237	Public signer-matched THost9 SHA-256
5652e2256df133a429f329ba60fe78c67ce63e089a5a3d58e4ff3d058ef7a708	Earliest located THost4 SHA-256
54d4ee85175a249dcb576716edf491d09fa05dfdfc492ff710a0cb711f9a35ab	Recovered tc9.dex SHA-256
45f71eb7ee96f80a1e865b2249452b603b729f4fc4c6f02ed00cadcdacf8f384	Embedded tc9 installer SHA-256
12fb8fe6cd895044e38217dd5945b0ec810f667660fd87dbb21687ea42084589	Embedded ADB public-key SHA-256

Device and Runtime Indicators

Look for these artifacts in the context of the Hagaseca package or related activity. Short filenames such as .logs and .1, and standard ADB mDNS names, are not unique to this malware.

Indicator	Purpose or behavior
com.hagaseca.thost9	Package name
com.hagaseca.loader.Main	Loader application class
com.hagaseca.thost9.Main	Hidden activity
com.hagaseca.thost9/.AS	Accessibility service
com.hagaseca.thost9/.Fore	Foreground service
com.hagaseca.thost9/.Boot	BOOT_COMPLETED receiver
.hg.db	Private packed-payload cache
.tc9	Private downloaded-stage cache
tc9.dex	Requested stage identifier
com.hagaseca.tc9.Main	Recovered stage entry class
.mods, .logs, .1	Stage module, log, and scan-state files
/data/.hg/com.hagaseca.thost9/com.hagaseca.thost9.apk	Privileged installer copy
_adb-tls-connect._tcp, _adb-tls-pairing._tcp, _adb._tcp	ADB mDNS discovery names
com.hagaseca.worm, com.hagaseca.threads_mon_tc9	Stage worker names
start_as, as_port	S1 local-controller markers
TCP 64737 downward	Wildcard accessibility command socket
.hagaseca.guard	Truncated S2 anti-Frida thread name
HAGASECA: GOODNIGHT	Anti-Frida exit marker
enabled_accessibility_services containing .AS	High-value persistence/control setting

Network Indicators

Indicator	Role
test[.]hagaseca[.]com	THost9 hardcoded C2 hostname
https://test[.]hagaseca[.]com/ws	THost9 stage endpoint
79[.]110[.]49[.]156	Collection-time A record; re-resolve before IP blocking
hagaseca[.]pleasedonthackmyserver[.]com	Historical THost4 host
http://hagaseca[.]pleasedonthackmyserver[.]com/hagaseca/gta	Historical THost4 polling URL
Connection: upgrade and Upgrade: websocket	HTTP/1.0 transport markers
hg-token	Lowercase MD5 of requested stage name
hg-type: kita	Stage-hash query marker
user-agent beginning h109	S2 device-profile format
user-agent beginning c210	Recovered-stage device/network profile
5[.]223[.]50[.]199 / https://api[.]ipapi[.]is	Stage network-profile lookup; not primary C2
TCP 5554/5555 and Android ADB mDNS	Propagation and ADB-control surface
434e584e01000001000010000600000032020000bcb1a7b1686f73743a3a	Raw ADB CNXN discovery probe

Recommended Response Actions

1. Remove public ADB exposure. Bind Redroid publishing to localhost and require an authenticated tunnel for remote access.
2. Isolate devices containing com.hagaseca.thost9 and preserve package, signer, logcat, notification, socket, accessibility, ADB-property, and install-timeline evidence before removal.
3. Preserve persistent Redroid /data volumes, .tc9, .mods, .logs, .1, /data/.hg, ADB keys, and install history.
4. Block the listed examined-file hashes and the shared certificate fingerprint in mobile application-vetting and MDM controls.
5. Monitor and deny the hardcoded C2 while treating its IP as time-sensitive shared-hosting infrastructure.
6. Hunt historical telemetry for the THost4 hostname and /hagaseca/gta path.
7. Alert on hidden or blank-label packages that start persistent foreground services and request all accessibility event types with window-content access.
8. Audit enabled_accessibility_services for com.hagaseca.thost9/.AS and do not grant WRITE_SECURE_SETTINGS to untrusted packages.
9. Hunt for .hg.db, .tc9, .mods, .logs, .1, start_as, as_port, TCP 64737, /proc/self/maps reads, and HAGASECA: GOODNIGHT.
10. Detect ADB mDNS discovery, /16 bursts to a common ADB port, the raw CNXN probe, unexpected service.adb.tcp.port=5554, and ADB keys carrying the comment hagaseca.
11. Re-provision the device or persistent container data when privileged integrity cannot be re-established.

YARA Rules

The original rules below target the described APK structure and recovered DEX stage. Their logic and author metadata are retained unchanged.

Test them against the supplied samples and a representative clean-file set before operational deployment. This editorial review did not execute the rules. The APK rule requires a specific combination of archive strings; repacking or structural changes can cause misses. The stage rule explicitly checks DEX 037 and is not a universal rule for all DEX versions.

rule Android_RAT_Hagaseca_THost9
{
    meta:
        description = "Hagaseca THost9 Android RAT loader"
        author      = "Dark Atlas; @ELJoOker"
        date        = "2026-09-06"

    strings:
        $s1         = "META-INF/HAGASECA.EC" ascii
        $s2         = "META-INF/HAGASECA.SF" ascii
        $s3         = "hagaseca" ascii
        $s4         = "assets/hg" ascii
        $s5         = "res/string/a" ascii
        $s6         = "res/string/l" ascii
        $s7         = "res/xml/as.xml" ascii
        $s8         = "res/xml-v22/as.xml" ascii
        $s9         = "resources.arsc" ascii
        $s10        = "AndroidManifest.xml" ascii

    condition:
        uint32(0) == 0x04034b50 and
        filesize < 1MB and
        (
            ($s1 and $s2 and $s3 and $s4) and
            ($s5 and $s6 and $s7 and $s8 and $s9 and $s10)
        )
}

rule Android_RAT_Hagaseca_TC9_Stage
{
    meta:
        description = "Recovered Hagaseca THost9 tc9 RAT and ADB-worm stage"
        author      = "Dark Atlas; @ELJoOker"
        date        = "2026-09-06"
        sha256      = "54d4ee85175a249dcb576716edf491d09fa05dfdfc492ff710a0cb711f9a35ab"

    strings:
        $entry      = "Lcom/hagaseca/tc9/Main;" ascii
        $adb_mdns   = "Lcom/hagaseca/adb_mdns/AdbMdns;" ascii
        $nsd        = "Landroid/net/nsd/NsdManager$DiscoveryListener;" ascii
        $loader     = "dalvik.system.InMemoryDexClassLoader" ascii
        $tc9_class  = "Ltc9/k;" ascii

    condition:
        uint32(0) == 0x0a786564 and
        uint32(4) == 0x00373330 and
        filesize < 1MB and
        all of them
}

FAQ

What is Hagaseca THost9?

THost9 is a packed, multi-stage Android RAT and ADB worm using package com.hagaseca.thost9. Its APK conceals execution, maintains a foreground service, exposes accessibility-based UI control, and loads tc9.dex. The recovered stage supplies remote administration, modular code loading, ADB scanning/authentication, and installation.

Does THost9 spread like a worm?

Yes. The recovered stage discovers or scans ADB services, probes candidate endpoints, authenticates with prepared key material, downloads thost9.apk, and runs its installer. Its /16 expansion makes the behavior worm-like.

What does tc9.dex add?

The stage adds the remote RAT command surface, arbitrary shell execution, file transfer, TCP relay, reverse shell, downloadable modules, detailed device profiling, ADB discovery and scanning, raw ADB authentication, APK retrieval, and remote installation.

How does THost9 persist?

The APK registers a boot receiver, keeps .Fore as a foreground service, and restarts that service after destruction. The stage reinforces execution with a 15-minute alarm, while a privileged installer can enable the accessibility service and place the APK under /system/app.

What are the strongest detection signals?

The strongest static combination is the package, shared signing certificate, assets/hg, tc9.dex hash/class descriptors, private paths, and C2 markers. The strongest behavioral combination is a hidden package with a blank foreground notification, unexpected accessibility enablement, a wildcard listener near TCP 64737, ADB mDNS or /16 scan activity, the raw CNXN probe, ADB property changes, and repeated C2 attempts.

Conclusion

THost9 is a packed, multi-stage Android RAT and ADB worm. Its package namespace, signing certificate, service names, embedded stage contract, custom protocol markers, and infrastructure form a durable Hagaseca cluster signature.

THost4 is the earliest located Hagaseca-named THost artifact, followed by signed THost9 artifacts and exposed-ADB incidents through 2026. Multiple incident records directly connect the cluster with exposed ADB and Redroid systems, and the recovered stage implements the matching scan, authentication, installation, and ADB-property control paths.

At binary level, THost9 is a packed and recoverable multi-stage RAT. Its APK implementations combine hidden foreground execution, boot persistence, accessibility control, an unauthenticated local socket, custom encrypted staging, and anti-Frida behavior in a newer build. The recovered tc9.dex supplies arbitrary shell execution, file transfer, TCP relay, reverse shell, downloaded modules, ADB discovery and /16 scanning, raw ADB authentication, APK retrieval, installation, ADB property control, and an additional alarm-based persistence layer.

The response priorities are clear: close and audit exposed ADB; identify and isolate THost9 through its package, signer, hashes, accessibility behavior, service state, stage files, scan pattern, and C2 markers; and preserve /data, .tc9, .mods, ADB keys, network captures, and install provenance before remediation.

The recovered stage aligns the public incident record with code and gives defenders stable opportunities across the APK, signer, services, files, accessibility state, C2 protocol, ADB scan pattern, and installer behavior.