THost9 Android RAT Pairs Packed Loader With ADB Worm

Dark Atlas analyzed an Android remote-access trojan (THost9) within the Hagaseca cluster that uses a packed loader (XOR + gzip) to deploy a second-stage payload (tc9.dex) offering shell execution, file transfer, tunneling, modules and a remote controller. The second-stage includes an ADB worm that discovers exposed ADB/Redroid services, probes large address ranges with concurrent workers, authenticates using prepared ADB keys, and installs itself — potentially altering ports and copying to system directories; researchers observed active C2 behavior, anti-analysis checks (Frida), and recommended removing public ADB exposure and inspecting accessibility services and persistent Redroid data.