THost9 Android RAT Uses Packed Loader and ADB Worm for Widespread Infection
A sophisticated Android RAT, dubbed THost9, employs a packed loader to conceal its payload and an ADB worm to spread laterally across vulnerable devices and containers.
Researchers have identified a new Android remote access trojan (RAT) that combines a sophisticated packed loader with a self-propagating worm. The malware, tracked as THost9 by Dark Atlas, utilizes a multi-stage approach to conceal its malicious activities and spread across vulnerable Android devices and containers.
The initial stage involves a packed loader that hides executable code within an Android application package. This loader decodes and decompresses the embedded payload, identified as tc9.dex, using a single-byte XOR operation and gzip decompression before dynamically loading it. This obfuscation technique makes it challenging for security solutions to detect the malicious payload at first glance.
Once the second-stage payload is loaded, THost9 establishes a foreground service, removes its presence from the Android Recents view, and uses a minimal notification to remain inconspicuous. In certain configurations, it can enable an accessibility service, granting it extensive control over the device's interface, provided the user has already granted the protected settings permission.
The second stage of THost9 is significantly more potent, offering capabilities such as shell execution, file transfers, tunneling, and reverse-shell access. It also supports downloadable modules, allowing attackers to extend its functionality dynamically. Dark Atlas noted that one tested build included a local controller that accepted commands without authentication, although binding to all interfaces did not necessarily mean it was reachable from the internet.
A notable addition in newer builds is an anti-analysis check designed to detect the presence of Frida, a popular instrumentation framework used by security researchers. If Frida is detected, the malware sample will exit, further complicating analysis efforts.
The most concerning propagation mechanism is the built-in ADB worm. This component actively scans for exposed Android Debug Bridge (ADB) services, either through local service discovery or operator-defined targets. It can then probe a vast range of hosts, up to 65,025, using multiple worker threads.
Upon finding an accessible ADB service, the worm attempts to authenticate using prepared ADB key material. If successful, it retrieves the installer package and executes it on the target device. In privileged remote sessions, the malware can alter ADB settings and ports and copy itself into a system directory, ensuring persistence and further spread.
Public incident reports indicate that THost9 and its predecessor, THost4, have been linked to infections on both Android phones and Redroid containers that had exposed ADB services. The researchers recommend removing public ADB exposure, reviewing accessibility service permissions, and scrutinizing persistent Redroid data to mitigate the risk posed by this threat.