THost9 Android RAT Pairs Packed Loader With ADB Worm
Dark Atlas details THost9, a packed Android RAT paired with an ADB worm that installs itself on devices with exposed Android Debug Bridge services.
Dark Atlas researchers described the Hagaseca cluster, whose THost9 packed loader hides executable code in an embedded asset decoded with single-byte XOR and gzip before loading a tc9.dex second stage. The second stage adds shell execution, file transfer, tunneling, reverse shells, downloadable modules and a self-propagating ADB worm that expands single addresses into 65,025-host scan ranges. Newer builds include anti-analysis checks for Frida, and incident reports connect THost9 and THost4 to Android phones and Redroid containers with exposed ADB from October 2024 through 2026.
- Loader decodes embedded asset with single-byte XOR and gzip before dynamic payload load
- Second stage tc9.dex adds shell execution, tunneling, reverse shell and downloadable modules
- ADB worm expands one address to a 65,025-host range probed with 50 workers
- Newer build exits when Frida instrumentation markers are detected
- Researchers urge removing public ADB exposure and reviewing accessibility services
- Vendors
- Dark Atlas
From the original article
2 min read at infosecurity-magazine.com
THost9 hides its payload and uses ADB to spread across exposed Android devices and containers
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.