MalwareUsed by 1 actor

THost9

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Hagaseca

A new Android remote access trojan (RAT), tracked as THost9 and part of the Hagaseca cluster, employs a concealed loader and an ADB worm to install itself on vulnerable devices with exposed Android Debug Bridge services.

via scworldscworld.com

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence2

This payload, tc9.dex, provides capabilities such as shell execution, file transfers, tunneling, and reverse-shell access.

Persistence

1 technique

T1546.011Application ShimmingEvidence1

It could enable an accessibility service giving control over the device interface, but only where the protected settings permission had already been granted.

Privilege Escalation

1 technique

T1546.011Application ShimmingEvidence1

It could enable an accessibility service giving control over the device interface, but only where the protected settings permission had already been granted.

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence2

The malware utilizes a packed loader that hides executable code within an Android application package, decoding it with a single-byte XOR operation and decompressing it with gzip.

T1140Deobfuscate/Decode Files or InformationEvidence1

The packed loader hides executable code within an Android application package, decoding it with a single-byte XOR operation and decompressing it with gzip.

T1564Hide ArtifactsEvidence1

The loader then started a foreground service, removed its activity from Android's Recents view and used a nearly blank notification.

T1620Reflective Code LoadingEvidence2

After decoding and decompression, the loader dynamically loads a second-stage payload, tc9.dex.

T1622Debugger EvasionEvidence1

A newer build added an anti-analysis check for Frida... When the marker was detected, the sample exited.

Discovery

2 techniques

T1046Network Service DiscoveryEvidence2

The ADB worm "actively scans for exposed Android Debug Bridge (ADB) services" and "discovers ADB services" before attempting installation.

T1622Debugger EvasionEvidence1

A newer build added an anti-analysis check for Frida... When the marker was detected, the sample exited.

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

It then authenticated using prepared ADB key material, retrieved the installer package and ran it.

Command and Control

3 techniques

T1090ProxyEvidence1

The second stage added shell execution, file transfers, tunneling, reverse-shell access and downloadable modules.

T1105Ingress Tool TransferEvidence1

The second stage added shell execution, file transfers, tunneling, reverse-shell access and downloadable modules.

T1572Protocol TunnelingEvidence1

This payload, tc9.dex, provides capabilities such as shell execution, file transfers, tunneling, and reverse-shell access.

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

Where the remote session was privileged, it could alter ADB settings and ports and copy itself into a system directory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

scworldNews

Sep 8, 2026

New Android RAT uses worm to target exposed ADB services | brief | SC Media

Android remote-access trojan with a packed, XOR-decoded and gzip-decompressed loader that dynamically loads the tc9.dex second-stage payload. It supports shell execution, file transfer, tunneling, and reverse-shell access, and propagates by scanning for exposed ADB services, authenticating with prepared key material, and installing itself.

infosecurity magazine newsNews

Sep 8, 2026

THost9 Android RAT Pairs Packed Loader With ADB Worm - Infosecurity Magazine

Packed Android remote-access trojan with a concealed loader and second-stage payload. It supports shell execution, file transfers, tunneling, reverse-shell access, downloadable modules, optional accessibility-service control, and unauthenticated local-controller commands in one tested build. Its integrated ADB worm discovers or targets exposed ADB services, scans expanded address ranges, authenticates using prepared ADB keys, and installs the malware on reachable devices.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

THost9

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Hagaseca

via scworldscworld.com

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence2

This payload, tc9.dex, provides capabilities such as shell execution, file transfers, tunneling, and reverse-shell access.

Persistence

1 technique

T1546.011Application ShimmingEvidence1

It could enable an accessibility service giving control over the device interface, but only where the protected settings permission had already been granted.

Privilege Escalation

1 technique

T1546.011Application ShimmingEvidence1

It could enable an accessibility service giving control over the device interface, but only where the protected settings permission had already been granted.

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence2

The malware utilizes a packed loader that hides executable code within an Android application package, decoding it with a single-byte XOR operation and decompressing it with gzip.

T1140Deobfuscate/Decode Files or InformationEvidence1

The packed loader hides executable code within an Android application package, decoding it with a single-byte XOR operation and decompressing it with gzip.

T1564Hide ArtifactsEvidence1

The loader then started a foreground service, removed its activity from Android's Recents view and used a nearly blank notification.

T1620Reflective Code LoadingEvidence2

After decoding and decompression, the loader dynamically loads a second-stage payload, tc9.dex.

T1622Debugger EvasionEvidence1

A newer build added an anti-analysis check for Frida... When the marker was detected, the sample exited.

Discovery

2 techniques

T1046Network Service DiscoveryEvidence2

The ADB worm "actively scans for exposed Android Debug Bridge (ADB) services" and "discovers ADB services" before attempting installation.

T1622Debugger EvasionEvidence1

A newer build added an anti-analysis check for Frida... When the marker was detected, the sample exited.

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

It then authenticated using prepared ADB key material, retrieved the installer package and ran it.

Command and Control

3 techniques

T1090ProxyEvidence1

The second stage added shell execution, file transfers, tunneling, reverse-shell access and downloadable modules.

T1105Ingress Tool TransferEvidence1

The second stage added shell execution, file transfers, tunneling, reverse-shell access and downloadable modules.

T1572Protocol TunnelingEvidence1

This payload, tc9.dex, provides capabilities such as shell execution, file transfers, tunneling, and reverse-shell access.

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

Where the remote session was privileged, it could alter ADB settings and ports and copy itself into a system directory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

scworldNews

Sep 8, 2026

New Android RAT uses worm to target exposed ADB services | brief | SC Media

infosecurity magazine newsNews

Sep 8, 2026

THost9 Android RAT Pairs Packed Loader With ADB Worm - Infosecurity Magazine

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.