// BULWARK-YARA-CAPTURE v1
// generator = "bulwark-black-ioc/yara_capture v1"
// article = "https://bulwarkblack.com/thost9-android-adb-debug-exposure-compromise-review/"
// captured = "2026-09-09T20:04:49Z"
// rules = 2
// capture_sha256 = "25093d73a3348515c622be56431d64310eea2c41a5851d8b5a1fedf600810b6d"
// origin[Android_RAT_Hagaseca_THost9] = "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader"
// origin[Android_RAT_Hagaseca_TC9_Stage] = "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader"
//

rule Android_RAT_Hagaseca_THost9
{
    meta:
        description = "Hagaseca THost9 Android RAT loader"
        author      = "Dark Atlas; @ELJoOker"
        date        = "2026-09-06"

    strings:
        $s1         = "META-INF/HAGASECA.EC" ascii
        $s2         = "META-INF/HAGASECA.SF" ascii
        $s3         = "hagaseca" ascii
        $s4         = "assets/hg" ascii
        $s5         = "res/string/a" ascii
        $s6         = "res/string/l" ascii
        $s7         = "res/xml/as.xml" ascii
        $s8         = "res/xml-v22/as.xml" ascii
        $s9         = "resources.arsc" ascii
        $s10        = "AndroidManifest.xml" ascii

    condition:
        uint32(0) == 0x04034b50 and
        filesize < 1MB and
        (
            ($s1 and $s2 and $s3 and $s4) and
            ($s5 and $s6 and $s7 and $s8 and $s9 and $s10)
        )
}

rule Android_RAT_Hagaseca_TC9_Stage
{
    meta:
        description = "Recovered Hagaseca THost9 tc9 RAT and ADB-worm stage"
        author      = "Dark Atlas; @ELJoOker"
        date        = "2026-09-06"
        sha256      = "54d4ee85175a249dcb576716edf491d09fa05dfdfc492ff710a0cb711f9a35ab"

    strings:
        $entry      = "Lcom/hagaseca/tc9/Main;" ascii
        $adb_mdns   = "Lcom/hagaseca/adb_mdns/AdbMdns;" ascii
        $nsd        = "Landroid/net/nsd/NsdManager$DiscoveryListener;" ascii
        $loader     = "dalvik.system.InMemoryDexClassLoader" ascii
        $tc9_class  = "Ltc9/k;" ascii

    condition:
        uint32(0) == 0x0a786564 and
        uint32(4) == 0x00373330 and
        filesize < 1MB and
        all of them
}