A packed Android remote access trojan (RAT) known as THost9 has combined a concealed loader with a worm that scans for exposed Android Debug Bridge (ADB) services and installs itself on reachable devices. Dark Atlas described the malware’s structure, with the loader hiding executable code inside an Android application package and loading a second-stage payload named tc9[.]dex. The cluster is referred to as Hagaseca, sharing namespace, certificate and class names across samples.
The loader hides its payload by decoding an embedded asset with a single-byte XOR and decompressing it with gzip. It runs a foreground service, removes its activity from the Recents list, and uses a near-empty notification. The second stage expands capabilities to shell execution, file transfers, tunnelling, reverse shell access and downloadable modules.
In at least one tested build, a local controller accepted unauthenticated commands, though Dark Atlas noted that binding to all interfaces did not prove internet reachability. A newer build adds an anti-analysis check for Frida; if detected, the sample exits.
ADB propagation is the defining feature: the second stage can discover ADB services via local service discovery or operator selection, expand to a 65,025-host range, probe targets with 50 workers, authenticate with prepared ADB keys, retrieve the installer and run it, and, if privileged, alter ADB settings and copy itself into a system directory.
Remediation guidance in the report urges removing public ADB exposure and reviewing accessibility services and persistent Redroid data. The researchers linked THost9 to exposure events and cautioned that the evidence did not prove a fixed threat‑actor identity, though infections align with public ADB or Redroid exposure.