Hagaseca Inside a Packed Android RAT Loader

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader
• Blog Title: Hagaseca: Inside a Packed Android RAT Loader
• Suggested Section: Mobile Pentesting -> Android Applications Pentesting -> ADB Commands and Accessibility Services Abuse, with cross-references to Network Services Pentesting -> 5555 - Android Debug Bridge and Basic Forensic Methodology/Reversing for packed DEX extraction and dynamic loading

🎯 Content Summary

Classification, access conditions, and impact

Hagaseca is an artifact-defined Android malware cluster associated with exposed Android Debug Bridge (ADB) services. The post analyzes THost9, a packed, multi-stage Android remote-access trojan (RAT) and ADB worm. The APK hides executable DEX bytecode, loads a second-stage tc9.dex, maintains foreground and boot persistence, uses Accessibility for UI control, executes arbitrary shell commands, transfers files, creates TCP tunne...

🔧 Technical Details

ADB worm propagation: An Android malware stage can discover ADB through mDNS service names or accept an operator-selected IP:port, expand a target into a /16, probe 65,025 generated hosts with 50 workers, send a raw ADB CNXN frame, select AUTH or CNXN responders, authenticate with prepared keys, and open a remote shell. It can then retrieve an APK, execute an embedded installer, enable Accessibility, change ADB settings, start persistence, and repeat the process. The technique requires exposed or reachable ADB, accepted authentication, and sufficient privilege; scanning alone does not provide access.

Packed multi-stage Android loader: A loader can hide executable DEX code in an APK asset by storing a one-byte XOR key followed by XOR-obfuscated gzip data. It decodes and decompresses the asset, caches the wrapper, injects the recovered DEX at the beginning of the application class ...

🤖 Agent Actions

Updated src/network-services-pentesting/5555-android-debug-bridge.md with:

• ADB worm discovery and /16 scanning workflow.
• Raw CNXN probe and response interpretation.
• Authentication and privilege prerequisites.
• Incident-response triage commands.
• Redroid loopback-binding guidance.
• High-fanout ADB scan detection.
• Numbered primary references and citations.

Validation completed with git diff --check, packet-structure verification, forbidden-source checks, and reference URL availability checks.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting -> Android Applications Pentesting -> ADB Commands and Accessibility Services Abuse, with cross-references to Network Services Pentesting -> 5555 - Android Debug Bridge and Basic Forensic Methodology/Reversing for packed DEX extraction and dynamic loading".

Repository Maintenance:

• MD Files Formatting: 1032 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0