{ "intelligence": { "actors": [], "counts": { "actors": 0, "associated_entity_contexts": 0, "deduplicated_iocs": 26, "direct_entities": 60, "direct_relationships": 140, "invalid_iocs": 0, "iocs": 26, "mentioned": 4, "mitre_associated": 0, "mitre_direct": 0, "targets": 0, "techniques": 0, "unsupported_indicators": 4, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 0, "excluded_graph_objects": 0, "graph_complete": true, "graph_objects": 60, "graph_relationships": 140, "mitre_context_complete": true, "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "status_as_of": "2026-10-10T09:20:45+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:15.101Z", "updated_at": "2026-09-25T22:27:15.459Z" }, "description_available": false, "entity_type": "StixFile", "id": "000aa249-6269-43ce-8c47-33d61906f640", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "file--48dc6e18-f5cf-51cd-8148-5f74e1dbc9cc", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:26.632Z", "updated_at": "2026-09-25T22:27:26.934Z" }, "description_available": false, "entity_type": "StixFile", "id": "014eb6cb-b65e-43bc-8a2f-fd7e1011731f", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "file--87cfade6-aca6-530a-878c-a7167715ad7c", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:07.435Z", "updated_at": "2026-09-25T22:27:08.063Z" }, "description_available": false, "entity_type": "StixFile", "id": "0233b2d0-1212-4fe0-8eda-28370a757273", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "file--75fd1074-9441-5a5e-8979-f3cf8e7facad", "type": "StixFile" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:25.347Z", "updated_at": "2026-09-25T22:27:25.811Z" }, "description_available": false, "entity_type": "Url", "id": "025266ca-c80e-4e24-9e25-a64cbc668121", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "url--c2d29602-8b33-564c-9503-7d07ef5f8481", "type": "Url" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:27.620Z", "updated_at": "2026-09-25T22:27:28.228Z" }, "description_available": false, "entity_type": "Hostname", "id": "0b70a919-7001-4ddc-a6d9-fa913e499f51", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "hostname--f6a81ddf-eed7-5249-b4fe-b6fa3ad43d6d", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.335Z", "created_at": "2026-09-25T22:27:29.542Z", "modified": "2026-09-25T22:28:18.461Z", "updated_at": "2026-09-25T22:28:18.461Z" }, "description_available": false, "entity_type": "Indicator", "id": "10451f39-fc58-43f8-88a2-8abf495310f7", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--0c196099-bef3-5d50-9191-48749fe6cfd5", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:20.440Z", "updated_at": "2026-09-25T22:27:21.644Z" }, "description_available": false, "entity_type": "StixFile", "id": "13695d3d-a83d-4cc0-b96f-45f529a545c8", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "file--68509329-ac6f-5e15-aa67-577c4dcc2e82", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:14.319Z", "updated_at": "2026-09-25T22:27:14.834Z" }, "description_available": false, "entity_type": "StixFile", "id": "16cff726-e4e5-46e1-9268-1c38743320ae", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "file--243083ca-f946-5b8e-b63d-cf0f0012dc60", "type": "StixFile" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.331Z", "created_at": "2026-09-25T22:27:04.871Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-25T22:27:05.482Z", "updated_at": "2026-09-25T22:27:05.482Z" }, "description_available": false, "entity_type": "Malware", "id": "1d056287-b471-446a-8f47-c51780004af3", "is_inferred": false, "labels": [], "lang": "en", "name": "tc9", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "malware--28a262fa-a78d-5dc4-9155-e58f42f7464f", "type": "Malware" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:23.834Z", "updated_at": "2026-09-25T22:27:24.727Z" }, "description_available": false, "entity_type": "StixFile", "id": "1d7e80f9-ca1a-42d9-aa09-b75a5fc31f5d", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "file--bae73000-3117-5043-9809-0bbd9db97e34", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.364Z", "created_at": "2026-09-25T22:27:36.274Z", "modified": "2026-09-25T22:29:28.943Z", "updated_at": "2026-09-25T22:29:28.943Z" }, "description_available": false, "entity_type": "Indicator", "id": "229ac616-d04d-467c-85d3-b8054534e90f", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--d612b3eb-d758-5e3d-9b65-8889dfc80645", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:18.710Z", "updated_at": "2026-09-25T22:27:19.353Z" }, "description_available": false, "entity_type": "StixFile", "id": "2a9e21f9-ba9c-41c8-8b2f-080d9c9e47a2", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "file--2f3dc67f-96ea-5ed9-a2e0-33eac140b364", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.356Z", "created_at": "2026-09-25T22:27:33.155Z", "modified": "2026-09-25T22:28:37.610Z", "updated_at": "2026-09-25T22:28:37.610Z" }, "description_available": false, "entity_type": "Indicator", "id": "3bd23086-a121-42e3-86f3-df0c8e9a8e10", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--0cd639d0-7ceb-5776-a028-d7c907be7206", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:09.093Z", "updated_at": "2026-09-25T22:27:09.314Z" }, "description_available": false, "entity_type": "StixFile", "id": "4b14a071-e993-459d-b755-fac8c2b25693", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "file--e37dc0c7-b94d-5c94-85f3-9ac38b5cede8", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:17.144Z", "updated_at": "2026-09-25T22:27:17.570Z" }, "description_available": false, "entity_type": "StixFile", "id": "552a783a-2e40-4016-9e50-c1fb368fad40", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "file--25381d84-bedc-5fce-afb4-2831591616b7", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:18.702Z", "updated_at": "2026-09-25T22:27:19.350Z" }, "description_available": false, "entity_type": "StixFile", "id": "5cb05d64-6cf1-4365-9e5c-dbe2ab0af9d2", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "file--580cec93-a6fb-5862-b84c-cbaf0e444a5e", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:17.545Z", "updated_at": "2026-09-25T22:27:18.104Z" }, "description_available": false, "entity_type": "StixFile", "id": "63b2c2d6-f10c-4e22-a5e5-003ac04020bc", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "file--03e533ff-ee7a-551c-a758-b817b8b9e560", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.350Z", "created_at": "2026-09-25T22:27:32.144Z", "modified": "2026-09-25T22:28:32.937Z", "updated_at": "2026-09-25T22:28:32.937Z" }, "description_available": false, "entity_type": "Indicator", "id": "6a090dbe-89be-427d-b357-543592b728c4", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--a622902b-70a4-59f6-85e2-e6413135a1c7", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.405Z", "created_at": "2026-09-25T22:27:48.583Z", "modified": "2026-09-25T22:30:26.546Z", "updated_at": "2026-09-25T22:30:26.546Z" }, "description_available": false, "entity_type": "Indicator", "id": "6c98d07d-b770-4a45-9ae0-047940d0dacf", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--2f1c6458-24d1-5595-becc-ba9dc0318326", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:13.295Z", "updated_at": "2026-09-25T22:27:13.952Z" }, "description_available": false, "entity_type": "StixFile", "id": "6d7a7821-cf92-497c-9a11-ee6318b62d7b", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "file--7633d3da-a8c5-5ce6-b3a4-851cbdcce992", "type": "StixFile" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:23.817Z", "updated_at": "2026-09-25T22:28:12.225Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "701e361d-703f-4d87-b07b-c8aa4623cbcf", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "ipv4-addr--986d45e6-f026-5710-acad-9fdf664477f8", "type": "IPv4Addr" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:08.657Z", "updated_at": "2026-09-25T22:27:09.133Z" }, "description_available": false, "entity_type": "StixFile", "id": "79a24f04-8a9c-4517-8e68-93c2af71129c", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "file--c1ad2133-0906-5da9-8072-965222f52119", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.396Z", "created_at": "2026-09-25T22:27:45.992Z", "modified": "2026-09-25T22:30:05.318Z", "updated_at": "2026-09-25T22:30:05.318Z" }, "description_available": false, "entity_type": "Indicator", "id": "7b2f25c0-f120-4c9a-a7b4-6a77250b0d00", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--a458a5e0-486b-5e98-b87c-329687ddcd55", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.380Z", "created_at": "2026-09-25T22:27:39.918Z", "modified": "2026-09-25T22:29:47.189Z", "updated_at": "2026-09-25T22:29:47.189Z" }, "description_available": false, "entity_type": "Indicator", "id": "7ce5d8d7-6f53-4f55-97a3-14ff6dcb1b33", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--87f17842-ce49-57dd-aea9-1de633da5b1b", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.332Z", "created_at": "2026-09-25T22:27:28.592Z", "modified": "2026-09-28T22:34:08.946Z", "updated_at": "2026-09-28T22:34:08.946Z" }, "description_available": false, "entity_type": "Indicator", "id": "7e4f8594-7b59-4e26-bf6d-0c20249f143e", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--9c9974d0-cbeb-53a6-926a-5d9a692332cd", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:21.664Z", "updated_at": "2026-09-25T22:27:22.907Z" }, "description_available": false, "entity_type": "StixFile", "id": "805f8290-889a-4eb5-b65f-224fbf3ae9cc", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "file--1b2831c0-12c7-5720-8519-ba76f9ffbb70", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.403Z", "created_at": "2026-09-25T22:27:48.588Z", "modified": "2026-09-25T22:27:49.379Z", "updated_at": "2026-09-25T22:27:49.379Z" }, "description_available": false, "entity_type": "Indicator", "id": "84559950-df7c-4b00-907f-b1211e4aab8c", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--f931d619-1cfa-5bd3-b28c-dd03cdcc68f3", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:20.454Z", "updated_at": "2026-09-25T22:27:21.641Z" }, "description_available": false, "entity_type": "StixFile", "id": "85271749-9946-44a0-8b94-c9d9fdccc31e", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "file--21c8e2d9-899d-598c-b94f-c492fe41f4ea", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.393Z", "created_at": "2026-09-25T22:27:45.998Z", "modified": "2026-09-28T22:34:07.032Z", "updated_at": "2026-09-28T22:34:07.032Z" }, "description_available": false, "entity_type": "Indicator", "id": "87e06cbe-a9ad-439a-bfb8-1fd13fda476d", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--21f265a4-a75d-578f-97c3-99a9545c2f3e", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.341Z", "created_at": "2026-09-25T22:27:30.698Z", "modified": "2026-09-25T22:28:18.757Z", "updated_at": "2026-09-25T22:28:18.757Z" }, "description_available": false, "entity_type": "Indicator", "id": "89cabe93-9bc5-4fbd-ba8c-841cf092d466", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--2b7d611f-bb43-5afc-9c6b-03a6e2a4e446", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:19.671Z", "updated_at": "2026-09-25T22:27:19.975Z" }, "description_available": false, "entity_type": "StixFile", "id": "8dd66ad3-70bc-4e17-ba3e-b6f69211d15e", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "file--04048cc5-5db0-59fd-b782-c65fa17cdf25", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.353Z", "created_at": "2026-09-25T22:27:33.161Z", "modified": "2026-09-25T22:28:58.905Z", "updated_at": "2026-09-25T22:28:58.905Z" }, "description_available": false, "entity_type": "Indicator", "id": "92bd8bb3-bd42-4171-8545-933562aff4b4", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--29dfc667-2b4f-5747-a1f1-466b64ef0603", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:24.023Z", "updated_at": "2026-09-25T22:27:24.941Z" }, "description_available": false, "entity_type": "Url", "id": "9c61aa7a-d418-4ca3-b275-6194691bcc13", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "url--bf378328-9dc4-5b56-a440-b51d7155b578", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.344Z", "created_at": "2026-09-25T22:27:31.345Z", "modified": "2026-09-25T22:28:26.506Z", "updated_at": "2026-09-25T22:28:26.506Z" }, "description_available": false, "entity_type": "Indicator", "id": "9da135c1-b409-4440-b6e0-d32528759a4a", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--e5fccb92-4431-5791-a8f4-ca732a115bd1", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.398Z", "created_at": "2026-09-25T22:27:45.999Z", "modified": "2026-09-25T22:30:18.900Z", "updated_at": "2026-09-25T22:30:18.900Z" }, "description_available": false, "entity_type": "Indicator", "id": "9e98c83e-927c-4999-a139-eb2f7f0c07f4", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--5d066213-6558-502e-af09-224d45b945ae", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.375Z", "created_at": "2026-09-25T22:27:38.602Z", "modified": "2026-09-25T22:29:39.036Z", "updated_at": "2026-09-25T22:29:39.036Z" }, "description_available": false, "entity_type": "Indicator", "id": "a170338f-18cb-4125-9ec4-0cb43af62760", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--922bad56-7916-5561-8875-7230dc930590", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.378Z", "created_at": "2026-09-25T22:27:39.550Z", "modified": "2026-09-25T22:29:41.351Z", "updated_at": "2026-09-25T22:29:41.351Z" }, "description_available": false, "entity_type": "Indicator", "id": "a2550196-16e4-4f57-ba6f-fe19af53c1a5", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--306184bb-dbbf-55c9-9b5d-30635c208350", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.383Z", "created_at": "2026-09-25T22:27:39.906Z", "modified": "2026-09-25T22:29:45.350Z", "updated_at": "2026-09-25T22:29:45.350Z" }, "description_available": false, "entity_type": "Indicator", "id": "a606793c-2422-4ffb-adea-624f670f4f9a", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--c0d47cf7-d4e3-5036-a950-30e94b2b9c29", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:13.929Z", "updated_at": "2026-09-25T22:27:14.564Z" }, "description_available": false, "entity_type": "StixFile", "id": "a86ca6f3-c98c-423b-a243-e2c2bc9e26d1", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "file--0e3dd82a-c731-51de-bd74-5060ef50d556", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.369Z", "created_at": "2026-09-25T22:27:37.038Z", "modified": "2026-09-25T22:29:32.736Z", "updated_at": "2026-09-25T22:29:32.736Z" }, "description_available": false, "entity_type": "Indicator", "id": "bb9032ab-4f94-4206-b102-c24443d56c52", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--c77489dd-7b12-56d0-aef9-8f6a891e9a7e", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.372Z", "created_at": "2026-09-25T22:27:38.175Z", "modified": "2026-09-25T22:29:35.698Z", "updated_at": "2026-09-25T22:29:35.698Z" }, "description_available": false, "entity_type": "Indicator", "id": "bba5193a-00ec-4425-a8d9-9c607b2c6a8e", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--7469c935-6938-5f75-ae85-44c7262f5728", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.391Z", "created_at": "2026-09-25T22:27:42.661Z", "modified": "2026-09-28T22:34:09.184Z", "updated_at": "2026-09-28T22:34:09.184Z" }, "description_available": false, "entity_type": "Indicator", "id": "c18d5d31-aab6-42a0-b912-3ce011e6c24e", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--b8a5f30f-24b8-5285-9c06-6e122bf4ec01", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.361Z", "created_at": "2026-09-25T22:27:35.605Z", "modified": "2026-09-25T22:29:14.375Z", "updated_at": "2026-09-25T22:29:14.375Z" }, "description_available": false, "entity_type": "Indicator", "id": "c221f609-d916-4df5-ac09-d5ede33723f2", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--6078d42a-c9eb-5fe1-a524-90965f665645", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.367Z", "created_at": "2026-09-25T22:27:36.263Z", "modified": "2026-09-25T22:29:23.708Z", "updated_at": "2026-09-25T22:29:23.708Z" }, "description_available": false, "entity_type": "Indicator", "id": "c69a8fcd-e003-41dd-888a-12fb2c7c30fe", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--779b8154-b7b5-503e-81d6-e233aef43adb", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:27.542Z", "updated_at": "2026-09-25T22:27:28.042Z" }, "description_available": false, "entity_type": "Hostname", "id": "c7da9d27-4bf2-4ff8-bde0-0ba3c29f1f70", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "hostname--8f66bb08-cd9f-5209-bf5d-d233914f9fde", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.359Z", "created_at": "2026-09-25T22:27:33.758Z", "modified": "2026-09-25T22:28:42.164Z", "updated_at": "2026-09-25T22:28:42.164Z" }, "description_available": false, "entity_type": "Indicator", "id": "c83a70a9-14a5-4be3-a28a-2b8cc677794c", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--bb67a29f-bf8b-5df8-b3c1-ac4c28d7996d", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:17.158Z", "updated_at": "2026-09-25T22:27:17.571Z" }, "description_available": false, "entity_type": "StixFile", "id": "c8a9c76e-ee67-4ec3-a38d-c4478935ba86", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "file--0428f291-76a1-5915-903e-bfa39060b770", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.339Z", "created_at": "2026-09-25T22:27:29.542Z", "modified": "2026-09-25T22:28:15.180Z", "updated_at": "2026-09-25T22:28:15.180Z" }, "description_available": false, "entity_type": "Indicator", "id": "c98e33d4-4be3-4df9-a1c0-0998e52b60bf", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--18f4bef5-1935-5caa-92f3-9ccbdced7c10", "type": "Indicator" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.330Z", "created_at": "2026-09-25T22:27:02.854Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-25T22:27:04.348Z", "updated_at": "2026-09-25T22:27:04.348Z" }, "description_available": false, "entity_type": "Malware", "id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "is_inferred": false, "labels": [], "lang": "en", "name": "THost9", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "malware--8e82c82d-0e63-5cde-96e1-408bb666eb9b", "type": "Malware" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.388Z", "created_at": "2026-09-25T22:27:42.319Z", "modified": "2026-09-28T22:34:06.284Z", "updated_at": "2026-09-28T22:34:06.284Z" }, "description_available": false, "entity_type": "Indicator", "id": "ca9c016b-f6e6-4d2b-8b68-d79738de3cf5", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--03e39bc0-4ee7-5623-935b-efe334e99918", "type": "Indicator" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.329Z", "created_at": "2026-09-25T22:27:02.121Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-25T22:27:02.701Z", "updated_at": "2026-09-25T22:27:02.701Z" }, "description_available": false, "entity_type": "Malware", "id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "is_inferred": false, "labels": [], "lang": "en", "name": "Hagaseca", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "malware--85533b0a-71cb-5921-868c-9ef3f4cd5061", "type": "Malware" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:26.744Z", "updated_at": "2026-09-25T22:27:27.042Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "d4a1e657-9419-4204-947a-b5b0080ea28d", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "domain-name--d5f84d48-33e3-54f4-a9f0-6f326b1cd698", "type": "DomainName" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:09.603Z", "updated_at": "2026-09-25T22:27:13.253Z" }, "description_available": false, "entity_type": "StixFile", "id": "d763bb5a-6077-4d04-b554-cacd7c8e91f1", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "file--e8a3b0d2-972d-5adf-821a-cbc94073d105", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.386Z", "created_at": "2026-09-25T22:27:42.319Z", "modified": "2026-09-25T22:29:51.740Z", "updated_at": "2026-09-25T22:29:51.740Z" }, "description_available": false, "entity_type": "Indicator", "id": "df185928-e109-4e43-900e-3bd21c66eb82", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--5b2c67eb-faba-5600-a330-137f6db90580", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:07.807Z", "updated_at": "2026-09-25T22:27:08.378Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "df431b55-7856-4813-abb8-556edb5f7d27", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "domain-name--69f53312-0e25-5f3a-ae4d-40941df27ed8", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.401Z", "created_at": "2026-09-25T22:27:48.193Z", "modified": "2026-09-25T22:30:21.173Z", "updated_at": "2026-09-25T22:30:21.173Z" }, "description_available": false, "entity_type": "Indicator", "id": "dfe0c7a7-9c02-460c-b135-6ba74ffc888d", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--30dfe68b-2a09-5e95-895f-df70e10e2109", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.347Z", "created_at": "2026-09-25T22:27:31.341Z", "modified": "2026-09-25T22:28:32.623Z", "updated_at": "2026-09-25T22:28:32.623Z" }, "description_available": false, "entity_type": "Indicator", "id": "e009e973-4c8b-49df-8b5d-d18bcad29d6d", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "indicator--f5f5b0b3-6172-58ac-9571-cbead21fd635", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:26.539Z", "updated_at": "2026-09-25T22:27:26.869Z" }, "description_available": false, "entity_type": "StixFile", "id": "ef9e1a88-8647-41fb-ae93-f688003f88e8", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "file--4fe12a90-e1be-588d-b8ef-f6852393d7f2", "type": "StixFile" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.331Z", "created_at": "2026-09-25T22:27:04.211Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-25T22:27:04.935Z", "updated_at": "2026-09-25T22:27:04.935Z" }, "description_available": false, "entity_type": "Malware", "id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "is_inferred": false, "labels": [], "lang": "en", "name": "THost4", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "malware--95e5e734-3336-569c-9ee7-1ca8395bce68", "type": "Malware" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T22:27:07.589Z", "updated_at": "2026-09-25T22:27:08.064Z" }, "description_available": false, "entity_type": "Url", "id": "f6d5cd19-7533-40cb-8138-23fef513afae", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "url--b42ddec8-1875-5c71-953b-2305be46f7e9", "type": "Url" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.404Z", "created_at": "2026-09-25T22:29:12.007Z", "modified": "2026-09-25T22:29:15.564Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:15.564Z" }, "description_available": false, "entity_type": "based-on", "fromId": "84559950-df7c-4b00-907f-b1211e4aab8c", "from_id": "84559950-df7c-4b00-907f-b1211e4aab8c", "from_name": null, "from_type": "Indicator", "id": "011f437e-e6b4-4f1a-8fb0-f6eb4ce7aca9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--c231b401-0089-597c-8fc0-b47810e26164", "toId": "c7da9d27-4bf2-4ff8-bde0-0ba3c29f1f70", "to_id": "c7da9d27-4bf2-4ff8-bde0-0ba3c29f1f70", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.431Z", "created_at": "2026-09-25T22:30:15.175Z", "modified": "2026-09-25T22:30:17.160Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:17.160Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c83a70a9-14a5-4be3-a28a-2b8cc677794c", "from_id": "c83a70a9-14a5-4be3-a28a-2b8cc677794c", "from_name": null, "from_type": "Indicator", "id": "02c0d224-783f-4fb7-b378-bb33dbf6287d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--2b8bcca1-32fc-51bd-8853-62e444b2db10", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.418Z", "created_at": "2026-09-25T22:29:39.569Z", "modified": "2026-09-25T22:29:40.329Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:40.329Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9da135c1-b409-4440-b6e0-d32528759a4a", "from_id": "9da135c1-b409-4440-b6e0-d32528759a4a", "from_name": null, "from_type": "Indicator", "id": "02f64f92-1e53-4039-99b7-c1ac6a522523", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--28f40348-bc76-58c8-a5c0-8384dc5e175c", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.472Z", "created_at": "2026-09-25T22:30:58.740Z", "modified": "2026-09-25T22:30:58.959Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:58.959Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6c98d07d-b770-4a45-9ae0-047940d0dacf", "from_id": "6c98d07d-b770-4a45-9ae0-047940d0dacf", "from_name": null, "from_type": "Indicator", "id": "04205719-8b24-40ed-b725-5ce5c8b9f0df", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--609e855e-2ac8-5d9d-9060-0c1b6f21c92e", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.443Z", "created_at": "2026-09-25T22:30:26.796Z", "modified": "2026-09-25T22:30:27.065Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:27.065Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bba5193a-00ec-4425-a8d9-9c607b2c6a8e", "from_id": "bba5193a-00ec-4425-a8d9-9c607b2c6a8e", "from_name": null, "from_type": "Indicator", "id": "04792dfa-c75c-4ea8-a499-2de63f5d9e33", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--8e6f5fea-342d-5f9f-a47c-88a1b1e384a0", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.351Z", "created_at": "2026-09-25T22:27:54.313Z", "modified": "2026-09-25T22:27:54.821Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:27:54.821Z" }, "description_available": false, "entity_type": "based-on", "fromId": "6a090dbe-89be-427d-b357-543592b728c4", "from_id": "6a090dbe-89be-427d-b357-543592b728c4", "from_name": null, "from_type": "Indicator", "id": "05d12319-10e5-4674-be75-8c81b63ead7a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--44d02a3d-af3e-548f-8c89-91f057e0526e", "toId": "6d7a7821-cf92-497c-9a11-ee6318b62d7b", "to_id": "6d7a7821-cf92-497c-9a11-ee6318b62d7b", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.343Z", "created_at": "2026-09-25T22:27:51.083Z", "modified": "2026-09-25T22:27:51.614Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:27:51.614Z" }, "description_available": false, "entity_type": "based-on", "fromId": "89cabe93-9bc5-4fbd-ba8c-841cf092d466", "from_id": "89cabe93-9bc5-4fbd-ba8c-841cf092d466", "from_name": null, "from_type": "Indicator", "id": "08549618-c607-4b8c-bc0f-d9004106aa51", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--d758227a-451e-5bf4-b049-b728b03430e5", "toId": "79a24f04-8a9c-4517-8e68-93c2af71129c", "to_id": "79a24f04-8a9c-4517-8e68-93c2af71129c", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.450Z", "created_at": "2026-09-25T22:30:34.022Z", "modified": "2026-09-25T22:30:34.324Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:34.324Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7ce5d8d7-6f53-4f55-97a3-14ff6dcb1b33", "from_id": "7ce5d8d7-6f53-4f55-97a3-14ff6dcb1b33", "from_name": null, "from_type": "Indicator", "id": "09468467-f9f5-4820-aabf-4117837cc5ad", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--9f10e610-7108-5f97-a447-ba4ba1aa5b33", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.337Z", "created_at": "2026-09-25T22:27:50.859Z", "modified": "2026-09-25T22:27:51.254Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:27:51.254Z" }, "description_available": false, "entity_type": "based-on", "fromId": "10451f39-fc58-43f8-88a2-8abf495310f7", "from_id": "10451f39-fc58-43f8-88a2-8abf495310f7", "from_name": null, "from_type": "Indicator", "id": "09946712-685a-4d96-970a-d4c90c1443a0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--4a0f39ae-1e49-5e8b-af1b-f6a535368320", "toId": "df431b55-7856-4813-abb8-556edb5f7d27", "to_id": "df431b55-7856-4813-abb8-556edb5f7d27", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.449Z", "created_at": "2026-09-25T22:30:34.699Z", "modified": "2026-09-25T22:30:35.338Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:35.338Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7ce5d8d7-6f53-4f55-97a3-14ff6dcb1b33", "from_id": "7ce5d8d7-6f53-4f55-97a3-14ff6dcb1b33", "from_name": null, "from_type": "Indicator", "id": "0e1d7c8d-f58f-47a1-b233-1db876109dfd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--24700943-7cb0-5413-9c8a-c266580f5214", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.427Z", "created_at": "2026-09-25T22:29:51.713Z", "modified": "2026-09-25T22:29:52.122Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:52.122Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3bd23086-a121-42e3-86f3-df0c8e9a8e10", "from_id": "3bd23086-a121-42e3-86f3-df0c8e9a8e10", "from_name": null, "from_type": "Indicator", "id": "0fc50eed-fab6-4f02-96d6-dc1cef333d4c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--080ac862-5191-57f7-a662-be6d11357ca5", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.382Z", "created_at": "2026-09-25T22:28:17.055Z", "modified": "2026-09-25T22:28:20.512Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:28:20.512Z" }, "description_available": false, "entity_type": "based-on", "fromId": "7ce5d8d7-6f53-4f55-97a3-14ff6dcb1b33", "from_id": "7ce5d8d7-6f53-4f55-97a3-14ff6dcb1b33", "from_name": null, "from_type": "Indicator", "id": "105adf91-01fc-46a3-b102-f26e349344a0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--812b08e6-1a49-59ef-a923-8fcfa1ad4ac0", "toId": "85271749-9946-44a0-8b94-c9d9fdccc31e", "to_id": "85271749-9946-44a0-8b94-c9d9fdccc31e", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.468Z", "created_at": "2026-09-25T22:30:54.460Z", "modified": "2026-09-25T22:30:54.995Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:54.995Z" }, "description_available": false, "entity_type": "indicates", "fromId": "dfe0c7a7-9c02-460c-b135-6ba74ffc888d", "from_id": "dfe0c7a7-9c02-460c-b135-6ba74ffc888d", "from_name": null, "from_type": "Indicator", "id": "13151e26-fed3-409c-b347-14684b06a3ae", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--6cc32760-46c7-52ea-b13e-c1d8c5c23eaf", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.433Z", "created_at": "2026-09-25T22:30:18.286Z", "modified": "2026-09-25T22:30:18.481Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:18.481Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c221f609-d916-4df5-ac09-d5ede33723f2", "from_id": "c221f609-d916-4df5-ac09-d5ede33723f2", "from_name": null, "from_type": "Indicator", "id": "1375be0c-fcf1-4750-9e44-e45313ea8d98", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--c80c253a-a5a6-56a2-88fb-ad17faba56b7", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.456Z", "created_at": "2026-09-25T22:30:39.506Z", "modified": "2026-09-25T22:30:41.181Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:41.181Z" }, "description_available": false, "entity_type": "indicates", "fromId": "df185928-e109-4e43-900e-3bd21c66eb82", "from_id": "df185928-e109-4e43-900e-3bd21c66eb82", "from_name": null, "from_type": "Indicator", "id": "14287fc6-8e1d-44e2-9376-fe47544ec302", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--a757f9b3-9044-5587-956e-fc0b32360041", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.470Z", "created_at": "2026-09-25T22:30:59.739Z", "modified": "2026-09-25T22:30:59.895Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:59.895Z" }, "description_available": false, "entity_type": "indicates", "fromId": "84559950-df7c-4b00-907f-b1211e4aab8c", "from_id": "84559950-df7c-4b00-907f-b1211e4aab8c", "from_name": null, "from_type": "Indicator", "id": "14bd3154-77cb-42e2-a06c-2bb73f488a12", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--8a6b2a91-92f5-5516-ae3f-246a33b2f963", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.363Z", "created_at": "2026-09-25T22:27:58.390Z", "modified": "2026-09-25T22:28:03.683Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:28:03.683Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c221f609-d916-4df5-ac09-d5ede33723f2", "from_id": "c221f609-d916-4df5-ac09-d5ede33723f2", "from_name": null, "from_type": "Indicator", "id": "155bc656-28de-4b77-b8fc-47987f2ec4c9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--3be80a55-bdaf-510a-9829-7fcd3636323f", "toId": "552a783a-2e40-4016-9e50-c1fb368fad40", "to_id": "552a783a-2e40-4016-9e50-c1fb368fad40", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.422Z", "created_at": "2026-09-25T22:29:47.502Z", "modified": "2026-09-25T22:29:47.967Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:47.967Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6a090dbe-89be-427d-b357-543592b728c4", "from_id": "6a090dbe-89be-427d-b357-543592b728c4", "from_name": null, "from_type": "Indicator", "id": "170a829a-33c2-4cfb-912e-4177511b0aec", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--1c2c1746-e58c-55a7-84e5-ba8b24830cb5", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.416Z", "created_at": "2026-09-25T22:29:33.916Z", "modified": "2026-09-25T22:29:34.395Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:34.395Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9da135c1-b409-4440-b6e0-d32528759a4a", "from_id": "9da135c1-b409-4440-b6e0-d32528759a4a", "from_name": null, "from_type": "Indicator", "id": "189de4a5-66c9-4c98-aa4e-9bc7e3ff55ad", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--c23687db-3a27-5f78-b8a1-78a6f082b0e5", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.466Z", "created_at": "2026-09-25T22:30:52.710Z", "modified": "2026-09-25T22:30:53.266Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:53.266Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9e98c83e-927c-4999-a139-eb2f7f0c07f4", "from_id": "9e98c83e-927c-4999-a139-eb2f7f0c07f4", "from_name": null, "from_type": "Indicator", "id": "1cf404a9-14e4-4d28-82fd-9397b2c0b1f9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--d5ef193a-6a87-5f2c-bed4-c0c727182d02", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.465Z", "created_at": "2026-09-25T22:30:51.957Z", "modified": "2026-09-25T22:30:52.274Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:52.274Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9e98c83e-927c-4999-a139-eb2f7f0c07f4", "from_id": "9e98c83e-927c-4999-a139-eb2f7f0c07f4", "from_name": null, "from_type": "Indicator", "id": "1dc7bb43-fcbb-46a9-b76e-2928f7e9710b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--5134f1e8-29b7-5e22-9bd6-1131245da784", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.454Z", "created_at": "2026-09-25T22:30:38.759Z", "modified": "2026-09-25T22:30:39.162Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:39.162Z" }, "description_available": false, "entity_type": "indicates", "fromId": "df185928-e109-4e43-900e-3bd21c66eb82", "from_id": "df185928-e109-4e43-900e-3bd21c66eb82", "from_name": null, "from_type": "Indicator", "id": "1e6b3a07-6b4d-426f-a7c8-dbf5a3085612", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--ffdbcc76-1a23-5822-9459-b4b719fb1615", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.465Z", "created_at": "2026-09-25T22:30:51.935Z", "modified": "2026-09-25T22:30:52.208Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:52.208Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7b2f25c0-f120-4c9a-a7b4-6a77250b0d00", "from_id": "7b2f25c0-f120-4c9a-a7b4-6a77250b0d00", "from_name": null, "from_type": "Indicator", "id": "1f6c0cc6-9c2f-4cc5-8f72-7b21001b640b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--47c34a5c-d741-5b5e-aee0-bea59a41b79e", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.421Z", "created_at": "2026-09-25T22:29:44.792Z", "modified": "2026-09-25T22:29:45.181Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:45.181Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6a090dbe-89be-427d-b357-543592b728c4", "from_id": "6a090dbe-89be-427d-b357-543592b728c4", "from_name": null, "from_type": "Indicator", "id": "206765a1-b87e-4880-8c93-eb79d0acf9a4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--a17e6fda-2e76-5c46-88d8-bf5b2629efa7", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.408Z", "created_at": "2026-09-25T22:29:24.946Z", "modified": "2026-09-25T22:29:25.353Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:25.353Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7e4f8594-7b59-4e26-bf6d-0c20249f143e", "from_id": "7e4f8594-7b59-4e26-bf6d-0c20249f143e", "from_name": null, "from_type": "Indicator", "id": "20b17879-abdb-4d9d-b0cb-8c2e50560896", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--171cd427-37d1-5853-a67e-c1aa24fb706d", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.408Z", "created_at": "2026-09-25T22:29:18.458Z", "modified": "2026-09-25T22:29:19.361Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:19.361Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7e4f8594-7b59-4e26-bf6d-0c20249f143e", "from_id": "7e4f8594-7b59-4e26-bf6d-0c20249f143e", "from_name": null, "from_type": "Indicator", "id": "23ffa64a-a4ca-43b7-9934-5450ea11a665", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--b3ae634b-858e-5f7e-98f3-3a51359bf2eb", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.454Z", "created_at": "2026-09-25T22:30:36.965Z", "modified": "2026-09-25T22:30:37.431Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:37.431Z" }, "description_available": false, "entity_type": "indicates", "fromId": "df185928-e109-4e43-900e-3bd21c66eb82", "from_id": "df185928-e109-4e43-900e-3bd21c66eb82", "from_name": null, "from_type": "Indicator", "id": "24a28034-4fd2-43e2-8652-2f8f62167333", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--85ae36d0-f944-5cf2-8b8a-70341e86bcf3", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.429Z", "created_at": "2026-09-25T22:29:51.898Z", "modified": "2026-09-25T22:29:52.359Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:52.359Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c83a70a9-14a5-4be3-a28a-2b8cc677794c", "from_id": "c83a70a9-14a5-4be3-a28a-2b8cc677794c", "from_name": null, "from_type": "Indicator", "id": "26420436-7576-4f27-96c3-5800abc11d9f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--e65f2053-3b0d-5be1-b5b4-169b842ea3cc", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.451Z", "created_at": "2026-09-25T22:30:35.646Z", "modified": "2026-09-25T22:30:36.065Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:36.065Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a606793c-2422-4ffb-adea-624f670f4f9a", "from_id": "a606793c-2422-4ffb-adea-624f670f4f9a", "from_name": null, "from_type": "Indicator", "id": "26c35d8d-6389-461d-b7ea-01c3495e5364", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--5426d01a-0ee9-5eab-bab9-09f1f57878b6", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.455Z", "created_at": "2026-09-25T22:30:37.904Z", "modified": "2026-09-25T22:30:38.257Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:38.257Z" }, "description_available": false, "entity_type": "indicates", "fromId": "df185928-e109-4e43-900e-3bd21c66eb82", "from_id": "df185928-e109-4e43-900e-3bd21c66eb82", "from_name": null, "from_type": "Indicator", "id": "27facfcf-48c4-408d-b6e5-145f239ed23d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--dbd77c91-f98a-54ca-a2bb-2d0ae53bc6f5", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.437Z", "created_at": "2026-09-25T22:30:22.546Z", "modified": "2026-09-25T22:30:23.206Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:23.206Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c69a8fcd-e003-41dd-888a-12fb2c7c30fe", "from_id": "c69a8fcd-e003-41dd-888a-12fb2c7c30fe", "from_name": null, "from_type": "Indicator", "id": "2c46d037-caa0-41e5-a653-ccaba7874a89", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--4bcdaa2f-8dc2-5904-8f7b-6877f4989fc0", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.387Z", "created_at": "2026-09-25T22:28:26.392Z", "modified": "2026-09-25T22:28:37.191Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:28:37.191Z" }, "description_available": false, "entity_type": "based-on", "fromId": "df185928-e109-4e43-900e-3bd21c66eb82", "from_id": "df185928-e109-4e43-900e-3bd21c66eb82", "from_name": null, "from_type": "Indicator", "id": "2c8bd51f-b576-4531-9e8f-fe6a2521d32a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--535c070e-5716-5d40-8a02-520d0b37733f", "toId": "1d7e80f9-ca1a-42d9-aa09-b75a5fc31f5d", "to_id": "1d7e80f9-ca1a-42d9-aa09-b75a5fc31f5d", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.444Z", "created_at": "2026-09-25T22:30:26.948Z", "modified": "2026-09-25T22:30:27.327Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:27.327Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a170338f-18cb-4125-9ec4-0cb43af62760", "from_id": "a170338f-18cb-4125-9ec4-0cb43af62760", "from_name": null, "from_type": "Indicator", "id": "2d35ee64-1202-454e-a306-b91f51e8c205", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--6a4b121e-ab3c-5931-851c-fdda7628e9c4", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.463Z", "created_at": "2026-09-25T22:30:52.550Z", "modified": "2026-09-25T22:30:52.970Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:52.970Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7b2f25c0-f120-4c9a-a7b4-6a77250b0d00", "from_id": "7b2f25c0-f120-4c9a-a7b4-6a77250b0d00", "from_name": null, "from_type": "Indicator", "id": "2ec040b0-4b0a-4da2-8760-76ac3a9bc937", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--fc87414c-a758-5432-a995-37ec2cada17e", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.340Z", "created_at": "2026-09-25T22:27:51.070Z", "modified": "2026-09-25T22:27:51.613Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:27:51.613Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c98e33d4-4be3-4df9-a1c0-0998e52b60bf", "from_id": "c98e33d4-4be3-4df9-a1c0-0998e52b60bf", "from_name": null, "from_type": "Indicator", "id": "314a1ffe-9a46-49a5-81f8-abf6df3e53e4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--c36677fb-b82e-51ca-9f1e-7f5b22b4b831", "toId": "0233b2d0-1212-4fe0-8eda-28370a757273", "to_id": "0233b2d0-1212-4fe0-8eda-28370a757273", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.437Z", "created_at": "2026-09-25T22:30:21.239Z", "modified": "2026-09-25T22:30:21.724Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:21.724Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c69a8fcd-e003-41dd-888a-12fb2c7c30fe", "from_id": "c69a8fcd-e003-41dd-888a-12fb2c7c30fe", "from_name": null, "from_type": "Indicator", "id": "31f03dc1-7df0-43bb-a96f-6d67dca2a7db", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--3802e103-ad74-55e3-ad7d-ba169f151a90", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.424Z", "created_at": "2026-09-25T22:29:51.199Z", "modified": "2026-09-25T22:29:51.449Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:51.449Z" }, "description_available": false, "entity_type": "indicates", "fromId": "92bd8bb3-bd42-4171-8545-933562aff4b4", "from_id": "92bd8bb3-bd42-4171-8545-933562aff4b4", "from_name": null, "from_type": "Indicator", "id": "33b58f4c-69e0-4375-83f2-122419eeba3f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--a165a923-6fb5-5162-922e-e911a08ed131", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.445Z", "created_at": "2026-09-25T22:30:31.714Z", "modified": "2026-09-25T22:30:32.138Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:32.138Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a170338f-18cb-4125-9ec4-0cb43af62760", "from_id": "a170338f-18cb-4125-9ec4-0cb43af62760", "from_name": null, "from_type": "Indicator", "id": "347c84f6-8b24-4e1e-af3e-8d62ab5a2521", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--8de8ec40-abab-5380-ac90-baa96b09efd9", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.430Z", "created_at": "2026-09-25T22:29:53.200Z", "modified": "2026-09-25T22:29:56.630Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:56.630Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c83a70a9-14a5-4be3-a28a-2b8cc677794c", "from_id": "c83a70a9-14a5-4be3-a28a-2b8cc677794c", "from_name": null, "from_type": "Indicator", "id": "35e68559-6d0c-4316-bbf5-cae48e3d5840", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--708a1146-cb9d-58fa-8cd1-572b57497936", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.452Z", "created_at": "2026-09-25T22:30:37.820Z", "modified": "2026-09-25T22:30:38.063Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:38.063Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a606793c-2422-4ffb-adea-624f670f4f9a", "from_id": "a606793c-2422-4ffb-adea-624f670f4f9a", "from_name": null, "from_type": "Indicator", "id": "369bfc9d-2d5a-4eee-8b2e-f7d0dc4b00f5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--b57c3c20-42a9-584c-aed3-d93f836437b6", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.402Z", "created_at": "2026-09-25T22:29:04.985Z", "modified": "2026-09-25T22:29:08.690Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:08.690Z" }, "description_available": false, "entity_type": "based-on", "fromId": "dfe0c7a7-9c02-460c-b135-6ba74ffc888d", "from_id": "dfe0c7a7-9c02-460c-b135-6ba74ffc888d", "from_name": null, "from_type": "Indicator", "id": "3aa1afb8-2156-4152-b6f1-b4c5b1600f21", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--6ac1c627-c9ff-56d8-bac7-d25e5557994c", "toId": "d4a1e657-9419-4204-947a-b5b0080ea28d", "to_id": "d4a1e657-9419-4204-947a-b5b0080ea28d", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.424Z", "created_at": "2026-09-25T22:29:47.581Z", "modified": "2026-09-25T22:29:48.050Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:48.050Z" }, "description_available": false, "entity_type": "indicates", "fromId": "92bd8bb3-bd42-4171-8545-933562aff4b4", "from_id": "92bd8bb3-bd42-4171-8545-933562aff4b4", "from_name": null, "from_type": "Indicator", "id": "3e65da25-dd80-4ac7-8ddf-39ef9e6e5240", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--36cc0217-a904-5734-a16e-0ef73f52fda9", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.469Z", "created_at": "2026-09-25T22:30:55.496Z", "modified": "2026-09-25T22:30:56.467Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:56.467Z" }, "description_available": false, "entity_type": "indicates", "fromId": "dfe0c7a7-9c02-460c-b135-6ba74ffc888d", "from_id": "dfe0c7a7-9c02-460c-b135-6ba74ffc888d", "from_name": null, "from_type": "Indicator", "id": "3f70e6b6-9571-4f96-b41f-3f712e4cd77b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--2d2a58b3-f7b2-5fb4-93ff-b856120f7fd1", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.440Z", "created_at": "2026-09-25T22:30:24.949Z", "modified": "2026-09-25T22:30:25.427Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:25.427Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bb9032ab-4f94-4206-b102-c24443d56c52", "from_id": "bb9032ab-4f94-4206-b102-c24443d56c52", "from_name": null, "from_type": "Indicator", "id": "441aa2a5-69e6-4e2f-adbe-3bea0b0910b5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--296111ac-ce2e-5651-869b-6c94ef8c141e", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.467Z", "created_at": "2026-09-25T22:30:53.611Z", "modified": "2026-09-25T22:30:53.930Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:53.930Z" }, "description_available": false, "entity_type": "indicates", "fromId": "dfe0c7a7-9c02-460c-b135-6ba74ffc888d", "from_id": "dfe0c7a7-9c02-460c-b135-6ba74ffc888d", "from_name": null, "from_type": "Indicator", "id": "44ad2cd8-9037-494c-9651-744d892cb4ff", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--a50654ef-78b8-5e28-85b4-b3a52ae3f73b", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.435Z", "created_at": "2026-09-25T22:30:18.398Z", "modified": "2026-09-25T22:30:18.678Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:18.678Z" }, "description_available": false, "entity_type": "indicates", "fromId": "229ac616-d04d-467c-85d3-b8054534e90f", "from_id": "229ac616-d04d-467c-85d3-b8054534e90f", "from_name": null, "from_type": "Indicator", "id": "48dae2da-f5e7-4684-817f-3c23cb5cf75b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--98351857-6d1d-5545-adba-48df45aedb2d", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.430Z", "created_at": "2026-09-25T22:30:01.186Z", "modified": "2026-09-25T22:30:11.831Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:11.831Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c83a70a9-14a5-4be3-a28a-2b8cc677794c", "from_id": "c83a70a9-14a5-4be3-a28a-2b8cc677794c", "from_name": null, "from_type": "Indicator", "id": "49216f27-32ea-48c7-a65a-fb4853e7464f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--30ab3030-3f11-55b4-a43a-5fb402e88538", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.459Z", "created_at": "2026-09-25T22:30:45.467Z", "modified": "2026-09-25T22:30:46.508Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:46.508Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c18d5d31-aab6-42a0-b912-3ce011e6c24e", "from_id": "c18d5d31-aab6-42a0-b912-3ce011e6c24e", "from_name": null, "from_type": "Indicator", "id": "4ada853c-0d5a-4cac-a699-fa095b146640", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--51b9928f-b8b2-5ccc-b9f3-6fcba586985d", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.447Z", "created_at": "2026-09-25T22:30:31.209Z", "modified": "2026-09-25T22:30:31.494Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:31.494Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a2550196-16e4-4f57-ba6f-fe19af53c1a5", "from_id": "a2550196-16e4-4f57-ba6f-fe19af53c1a5", "from_name": null, "from_type": "Indicator", "id": "4b27cb95-82c5-4ea1-989c-0e7a01e76357", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--d70608e4-29f0-5e13-bc3a-c0d040f3760a", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.392Z", "created_at": "2026-09-25T22:28:32.586Z", "modified": "2026-09-25T22:28:44.946Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:28:44.946Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c18d5d31-aab6-42a0-b912-3ce011e6c24e", "from_id": "c18d5d31-aab6-42a0-b912-3ce011e6c24e", "from_name": null, "from_type": "Indicator", "id": "4c8d48cd-105b-4be0-9dfb-358725764ffb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--5759cae6-7f4e-5766-a2d6-76632a4826ad", "toId": "9c61aa7a-d418-4ca3-b275-6194691bcc13", "to_id": "9c61aa7a-d418-4ca3-b275-6194691bcc13", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.460Z", "created_at": "2026-09-25T22:30:47.304Z", "modified": "2026-09-25T22:30:48.796Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:48.796Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c18d5d31-aab6-42a0-b912-3ce011e6c24e", "from_id": "c18d5d31-aab6-42a0-b912-3ce011e6c24e", "from_name": null, "from_type": "Indicator", "id": "4d5ddc50-a9d8-444f-a554-ff8a8fa50810", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--1e3d0321-64bf-5597-8936-c377efc8e52f", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.384Z", "created_at": "2026-09-25T22:28:17.063Z", "modified": "2026-09-25T22:28:20.513Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:28:20.513Z" }, "description_available": false, "entity_type": "based-on", "fromId": "a606793c-2422-4ffb-adea-624f670f4f9a", "from_id": "a606793c-2422-4ffb-adea-624f670f4f9a", "from_name": null, "from_type": "Indicator", "id": "4ed6c165-53f3-4a09-876a-30540a264084", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--1c77bc9d-2e52-5cde-a542-0eeb64cb8d92", "toId": "805f8290-889a-4eb5-b65f-224fbf3ae9cc", "to_id": "805f8290-889a-4eb5-b65f-224fbf3ae9cc", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.409Z", "created_at": "2026-09-25T22:29:23.010Z", "modified": "2026-09-25T22:29:24.200Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:24.200Z" }, "description_available": false, "entity_type": "indicates", "fromId": "10451f39-fc58-43f8-88a2-8abf495310f7", "from_id": "10451f39-fc58-43f8-88a2-8abf495310f7", "from_name": null, "from_type": "Indicator", "id": "547d73b9-4f56-442e-8a18-7055670e44d0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--ce53c844-9535-5f73-95a2-16cc26ad6d31", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.423Z", "created_at": "2026-09-25T22:29:46.077Z", "modified": "2026-09-25T22:29:47.011Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:47.011Z" }, "description_available": false, "entity_type": "indicates", "fromId": "92bd8bb3-bd42-4171-8545-933562aff4b4", "from_id": "92bd8bb3-bd42-4171-8545-933562aff4b4", "from_name": null, "from_type": "Indicator", "id": "54aca21e-3716-4e40-96e1-025f82b3ffdf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--5c1387ff-ca1f-5a8b-9b96-765e1b104364", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.417Z", "created_at": "2026-09-25T22:29:37.054Z", "modified": "2026-09-25T22:29:37.571Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:37.571Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9da135c1-b409-4440-b6e0-d32528759a4a", "from_id": "9da135c1-b409-4440-b6e0-d32528759a4a", "from_name": null, "from_type": "Indicator", "id": "564a35a7-26f7-4a0b-9a3e-45a541313364", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--eb21cdb3-78c8-530b-900c-f44c371bb1c4", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.471Z", "created_at": "2026-09-25T22:30:57.697Z", "modified": "2026-09-25T22:30:58.095Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:58.095Z" }, "description_available": false, "entity_type": "indicates", "fromId": "84559950-df7c-4b00-907f-b1211e4aab8c", "from_id": "84559950-df7c-4b00-907f-b1211e4aab8c", "from_name": null, "from_type": "Indicator", "id": "56da0213-8e4a-494d-88b8-35867a8efbb2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--d93bad1e-92a8-590c-aa80-36a1daeca24e", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.461Z", "created_at": "2026-09-25T22:30:45.416Z", "modified": "2026-09-25T22:30:46.388Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:46.388Z" }, "description_available": false, "entity_type": "indicates", "fromId": "87e06cbe-a9ad-439a-bfb8-1fd13fda476d", "from_id": "87e06cbe-a9ad-439a-bfb8-1fd13fda476d", "from_name": null, "from_type": "Indicator", "id": "5bf468f2-df15-4402-a986-34227e9b5de4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--aacce6e6-a56c-5db2-bd0f-cbd0a9641457", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.394Z", "created_at": "2026-09-25T22:28:49.224Z", "modified": "2026-09-25T22:28:59.359Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:28:59.359Z" }, "description_available": false, "entity_type": "based-on", "fromId": "87e06cbe-a9ad-439a-bfb8-1fd13fda476d", "from_id": "87e06cbe-a9ad-439a-bfb8-1fd13fda476d", "from_name": null, "from_type": "Indicator", "id": "5cf269ab-c580-4e2e-a2fc-b8eea0eab640", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--313bda18-e48a-5243-a166-247f114cc701", "toId": "025266ca-c80e-4e24-9e25-a64cbc668121", "to_id": "025266ca-c80e-4e24-9e25-a64cbc668121", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.474Z", "created_at": "2026-09-25T22:31:00.762Z", "modified": "2026-09-25T22:31:00.992Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:31:00.992Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6c98d07d-b770-4a45-9ae0-047940d0dacf", "from_id": "6c98d07d-b770-4a45-9ae0-047940d0dacf", "from_name": null, "from_type": "Indicator", "id": "60d2f9e1-58bd-45ed-b0a5-c217fe4064fc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--f1b9bd07-5d14-5f7e-b0a5-07359d8f384d", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.411Z", "created_at": "2026-09-25T22:29:26.275Z", "modified": "2026-09-25T22:29:26.632Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:26.632Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c98e33d4-4be3-4df9-a1c0-0998e52b60bf", "from_id": "c98e33d4-4be3-4df9-a1c0-0998e52b60bf", "from_name": null, "from_type": "Indicator", "id": "628a1ac8-5fe3-418e-8f2d-a8f9781e8c06", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--c13b808f-cf0f-5317-b2ff-6635a08c267c", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.439Z", "created_at": "2026-09-25T22:30:22.878Z", "modified": "2026-09-25T22:30:24.355Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:24.355Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bb9032ab-4f94-4206-b102-c24443d56c52", "from_id": "bb9032ab-4f94-4206-b102-c24443d56c52", "from_name": null, "from_type": "Indicator", "id": "63a59048-61a6-444d-8f80-560c00c7d49d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--d05ea1fe-38dd-5f0a-9df5-52b99f8ff25c", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.422Z", "created_at": "2026-09-25T22:29:45.850Z", "modified": "2026-09-25T22:29:46.263Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:46.263Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6a090dbe-89be-427d-b357-543592b728c4", "from_id": "6a090dbe-89be-427d-b357-543592b728c4", "from_name": null, "from_type": "Indicator", "id": "64f803e5-d296-4327-94fc-8ae7a2da732c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--ca8d8af1-eb50-56ac-9f28-1274d8923ee9", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.413Z", "created_at": "2026-09-25T22:29:30.602Z", "modified": "2026-09-25T22:29:32.028Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:32.028Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c98e33d4-4be3-4df9-a1c0-0998e52b60bf", "from_id": "c98e33d4-4be3-4df9-a1c0-0998e52b60bf", "from_name": null, "from_type": "Indicator", "id": "6623c3f2-58ea-4966-a9ac-6339e276333e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--595e6ff1-75a3-5b00-91ad-ae757ca85a74", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.467Z", "created_at": "2026-09-25T22:30:54.917Z", "modified": "2026-09-25T22:30:55.328Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:55.328Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9e98c83e-927c-4999-a139-eb2f7f0c07f4", "from_id": "9e98c83e-927c-4999-a139-eb2f7f0c07f4", "from_name": null, "from_type": "Indicator", "id": "67b54cb7-cd8a-4902-85f3-e0c33adf0933", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--2c86d51e-6e0a-5d36-aa97-ac71e8e63335", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.470Z", "created_at": "2026-09-25T22:30:55.658Z", "modified": "2026-09-25T22:30:56.873Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:56.873Z" }, "description_available": false, "entity_type": "indicates", "fromId": "84559950-df7c-4b00-907f-b1211e4aab8c", "from_id": "84559950-df7c-4b00-907f-b1211e4aab8c", "from_name": null, "from_type": "Indicator", "id": "6aa77086-e5b4-4202-ab55-ab9f19c28a40", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--38ff1cfc-740c-51c1-a525-4d76d3d63164", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.463Z", "created_at": "2026-09-25T22:30:49.751Z", "modified": "2026-09-25T22:30:50.125Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:50.125Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7b2f25c0-f120-4c9a-a7b4-6a77250b0d00", "from_id": "7b2f25c0-f120-4c9a-a7b4-6a77250b0d00", "from_name": null, "from_type": "Indicator", "id": "6b10ca4a-1778-49ad-820a-1eb7b8399bc7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--1ed0f25f-a8bd-5425-9772-b3a177cfd22b", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.426Z", "created_at": "2026-09-25T22:29:50.096Z", "modified": "2026-09-25T22:29:51.261Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:51.261Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3bd23086-a121-42e3-86f3-df0c8e9a8e10", "from_id": "3bd23086-a121-42e3-86f3-df0c8e9a8e10", "from_name": null, "from_type": "Indicator", "id": "6bd4d5d2-312a-44df-8f64-bfd88c55ddb9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--554d9ea0-4f4b-5fd2-8334-6071b6fc581c", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.446Z", "created_at": "2026-09-25T22:30:28.682Z", "modified": "2026-09-25T22:30:28.903Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:28.903Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a2550196-16e4-4f57-ba6f-fe19af53c1a5", "from_id": "a2550196-16e4-4f57-ba6f-fe19af53c1a5", "from_name": null, "from_type": "Indicator", "id": "6ca9afbb-b8a6-42f6-89f3-0bd32ceebe9e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--a2cbf85d-b93c-50b3-9229-56e46c293dc5", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.462Z", "created_at": "2026-09-25T22:30:50.462Z", "modified": "2026-09-25T22:30:50.994Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:50.994Z" }, "description_available": false, "entity_type": "indicates", "fromId": "87e06cbe-a9ad-439a-bfb8-1fd13fda476d", "from_id": "87e06cbe-a9ad-439a-bfb8-1fd13fda476d", "from_name": null, "from_type": "Indicator", "id": "6d73edb5-5e32-470f-a73f-917339817c05", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--0f2c65ab-1fa9-5f0e-b266-8145ac808303", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.462Z", "created_at": "2026-09-25T22:30:49.456Z", "modified": "2026-09-25T22:30:49.906Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:49.906Z" }, "description_available": false, "entity_type": "indicates", "fromId": "87e06cbe-a9ad-439a-bfb8-1fd13fda476d", "from_id": "87e06cbe-a9ad-439a-bfb8-1fd13fda476d", "from_name": null, "from_type": "Indicator", "id": "70917e04-ed33-444a-8d6c-f1a05e4959bc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--22af04ff-b4ca-5479-be17-9aacaf46d375", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.447Z", "created_at": "2026-09-25T22:30:31.965Z", "modified": "2026-09-25T22:30:32.315Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:32.315Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a2550196-16e4-4f57-ba6f-fe19af53c1a5", "from_id": "a2550196-16e4-4f57-ba6f-fe19af53c1a5", "from_name": null, "from_type": "Indicator", "id": "715628e0-f132-4bc9-bda6-6515854a84a6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--1b88226c-e684-56b5-8d12-37cb946e0979", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.355Z", "created_at": "2026-09-25T22:27:55.352Z", "modified": "2026-09-25T22:27:56.287Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:27:56.287Z" }, "description_available": false, "entity_type": "based-on", "fromId": "92bd8bb3-bd42-4171-8545-933562aff4b4", "from_id": "92bd8bb3-bd42-4171-8545-933562aff4b4", "from_name": null, "from_type": "Indicator", "id": "78a98d34-dcaa-4118-b50c-48785da13159", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--40878ee3-a8e0-5268-ae05-59d0b236fae0", "toId": "a86ca6f3-c98c-423b-a243-e2c2bc9e26d1", "to_id": "a86ca6f3-c98c-423b-a243-e2c2bc9e26d1", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.426Z", "created_at": "2026-09-25T22:29:48.765Z", "modified": "2026-09-25T22:29:49.224Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:49.224Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3bd23086-a121-42e3-86f3-df0c8e9a8e10", "from_id": "3bd23086-a121-42e3-86f3-df0c8e9a8e10", "from_name": null, "from_type": "Indicator", "id": "791fd1b8-bc4c-4a4e-9067-02c37699f67f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--0e8ca4ba-76f2-54d4-b58e-21aaca700ba3", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.444Z", "created_at": "2026-09-25T22:30:28.784Z", "modified": "2026-09-25T22:30:29.203Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:29.203Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a170338f-18cb-4125-9ec4-0cb43af62760", "from_id": "a170338f-18cb-4125-9ec4-0cb43af62760", "from_name": null, "from_type": "Indicator", "id": "7c7d42e5-0daa-49cd-b989-14dcbc8f7464", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--9ec6df5a-5d44-575b-9dca-d1bf11023752", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.475Z", "created_at": "2026-09-25T22:30:59.897Z", "modified": "2026-09-25T22:31:00.296Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:31:00.296Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6c98d07d-b770-4a45-9ae0-047940d0dacf", "from_id": "6c98d07d-b770-4a45-9ae0-047940d0dacf", "from_name": null, "from_type": "Indicator", "id": "7f04cc95-a51f-408e-9758-d3f5a27ba426", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--8adc5357-9057-59e8-b8f6-3a89589c832a", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.448Z", "created_at": "2026-09-25T22:30:32.715Z", "modified": "2026-09-25T22:30:33.144Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:33.144Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7ce5d8d7-6f53-4f55-97a3-14ff6dcb1b33", "from_id": "7ce5d8d7-6f53-4f55-97a3-14ff6dcb1b33", "from_name": null, "from_type": "Indicator", "id": "7f5597fd-381e-4a33-96bb-7ac046fcd6ee", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--d150512f-ab92-508c-9c7e-03bb5859641b", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.414Z", "created_at": "2026-09-25T22:29:30.529Z", "modified": "2026-09-25T22:29:32.026Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:32.026Z" }, "description_available": false, "entity_type": "indicates", "fromId": "89cabe93-9bc5-4fbd-ba8c-841cf092d466", "from_id": "89cabe93-9bc5-4fbd-ba8c-841cf092d466", "from_name": null, "from_type": "Indicator", "id": "802b3882-173b-4f7d-8124-8ae233899228", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--f1f3470b-aefc-5e2e-b08a-4b0a8b0d15ac", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.439Z", "created_at": "2026-09-25T22:30:26.087Z", "modified": "2026-09-25T22:30:26.402Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:26.402Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bb9032ab-4f94-4206-b102-c24443d56c52", "from_id": "bb9032ab-4f94-4206-b102-c24443d56c52", "from_name": null, "from_type": "Indicator", "id": "85712c68-f575-4aa0-b14b-665282fe4660", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--0a4023cd-1f9c-5974-9d90-102dd056f630", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.466Z", "created_at": "2026-09-25T22:30:53.712Z", "modified": "2026-09-25T22:30:54.163Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:54.163Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9e98c83e-927c-4999-a139-eb2f7f0c07f4", "from_id": "9e98c83e-927c-4999-a139-eb2f7f0c07f4", "from_name": null, "from_type": "Indicator", "id": "88b10d7a-4a89-424b-9124-6f83a025e3fa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--68e7b1fe-f3f5-53ef-b165-dc05cacb9851", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.376Z", "created_at": "2026-09-25T22:28:09.335Z", "modified": "2026-09-25T22:28:11.648Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:28:11.648Z" }, "description_available": false, "entity_type": "based-on", "fromId": "a170338f-18cb-4125-9ec4-0cb43af62760", "from_id": "a170338f-18cb-4125-9ec4-0cb43af62760", "from_name": null, "from_type": "Indicator", "id": "88fa20c6-54ea-4dc4-93c2-63996363604c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--a1326033-cda2-5ea0-87cf-20cc07fa1576", "toId": "8dd66ad3-70bc-4e17-ba3e-b6f69211d15e", "to_id": "8dd66ad3-70bc-4e17-ba3e-b6f69211d15e", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.435Z", "created_at": "2026-09-25T22:30:20.844Z", "modified": "2026-09-25T22:30:21.210Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:21.210Z" }, "description_available": false, "entity_type": "indicates", "fromId": "229ac616-d04d-467c-85d3-b8054534e90f", "from_id": "229ac616-d04d-467c-85d3-b8054534e90f", "from_name": null, "from_type": "Indicator", "id": "8a0770ff-a1d8-4b55-b703-0a1de5399490", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--8f917a88-9988-577e-b622-aa0465e4b92b", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.436Z", "created_at": "2026-09-25T22:30:19.532Z", "modified": "2026-09-25T22:30:19.844Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:19.844Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c69a8fcd-e003-41dd-888a-12fb2c7c30fe", "from_id": "c69a8fcd-e003-41dd-888a-12fb2c7c30fe", "from_name": null, "from_type": "Indicator", "id": "8a2d4bfd-0e3e-4b12-a981-32a0276f4835", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--b84a5c7f-446c-5c69-908d-405cd069b571", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.457Z", "created_at": "2026-09-25T22:30:39.419Z", "modified": "2026-09-25T22:30:39.611Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:39.611Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ca9c016b-f6e6-4d2b-8b68-d79738de3cf5", "from_id": "ca9c016b-f6e6-4d2b-8b68-d79738de3cf5", "from_name": null, "from_type": "Indicator", "id": "8dc151b3-33c7-49f5-a7d6-610ddb6c75fc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--f7f1ee52-9307-5e5d-8b66-0f9e7f46c3bb", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.461Z", "created_at": "2026-09-25T22:30:46.850Z", "modified": "2026-09-25T22:30:47.368Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:47.368Z" }, "description_available": false, "entity_type": "indicates", "fromId": "87e06cbe-a9ad-439a-bfb8-1fd13fda476d", "from_id": "87e06cbe-a9ad-439a-bfb8-1fd13fda476d", "from_name": null, "from_type": "Indicator", "id": "8f552492-17b7-4eee-ba7e-d680464dc7cc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--de06db6d-7ac6-5bc4-916d-cb27e5afcd93", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.397Z", "created_at": "2026-09-25T22:28:55.977Z", "modified": "2026-09-25T22:29:08.689Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:08.689Z" }, "description_available": false, "entity_type": "based-on", "fromId": "7b2f25c0-f120-4c9a-a7b4-6a77250b0d00", "from_id": "7b2f25c0-f120-4c9a-a7b4-6a77250b0d00", "from_name": null, "from_type": "Indicator", "id": "91192617-53a7-4775-9fd0-813b55897345", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--0b4e4996-c8fe-59a2-b6ea-d75a4179f5cc", "toId": "ef9e1a88-8647-41fb-ae93-f688003f88e8", "to_id": "ef9e1a88-8647-41fb-ae93-f688003f88e8", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.438Z", "created_at": "2026-09-25T22:30:21.615Z", "modified": "2026-09-25T22:30:21.924Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:21.924Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bb9032ab-4f94-4206-b102-c24443d56c52", "from_id": "bb9032ab-4f94-4206-b102-c24443d56c52", "from_name": null, "from_type": "Indicator", "id": "924c59fe-cba2-4db1-b3fb-2440370a8812", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--f1b88042-ad5d-5be5-ba4c-69e87ca5fa9c", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.390Z", "created_at": "2026-09-25T22:28:31.672Z", "modified": "2026-09-25T22:28:44.467Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:28:44.467Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ca9c016b-f6e6-4d2b-8b68-d79738de3cf5", "from_id": "ca9c016b-f6e6-4d2b-8b68-d79738de3cf5", "from_name": null, "from_type": "Indicator", "id": "9a5a1d36-5b42-4b7d-ba5c-c13ab3091058", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--d4dc06f0-255c-5371-a780-b54534246eb3", "toId": "701e361d-703f-4d87-b07b-c8aa4623cbcf", "to_id": "701e361d-703f-4d87-b07b-c8aa4623cbcf", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.448Z", "created_at": "2026-09-25T22:30:33.106Z", "modified": "2026-09-25T22:30:33.663Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:33.663Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a2550196-16e4-4f57-ba6f-fe19af53c1a5", "from_id": "a2550196-16e4-4f57-ba6f-fe19af53c1a5", "from_name": null, "from_type": "Indicator", "id": "9b33b16b-a610-4830-a275-ca3af35b68e6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--7c0d0b9c-5ee4-5618-95cb-e67e4afa2fe3", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.368Z", "created_at": "2026-09-25T22:27:58.374Z", "modified": "2026-09-25T22:28:03.681Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:28:03.681Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c69a8fcd-e003-41dd-888a-12fb2c7c30fe", "from_id": "c69a8fcd-e003-41dd-888a-12fb2c7c30fe", "from_name": null, "from_type": "Indicator", "id": "a1554223-4d7d-45f3-9ab2-f8dca43a9506", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--6472acf4-7b8b-5abf-95ce-1b8cb0a59c16", "toId": "63b2c2d6-f10c-4e22-a5e5-003ac04020bc", "to_id": "63b2c2d6-f10c-4e22-a5e5-003ac04020bc", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.415Z", "created_at": "2026-09-25T22:29:33.873Z", "modified": "2026-09-25T22:29:34.349Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:34.349Z" }, "description_available": false, "entity_type": "indicates", "fromId": "89cabe93-9bc5-4fbd-ba8c-841cf092d466", "from_id": "89cabe93-9bc5-4fbd-ba8c-841cf092d466", "from_name": null, "from_type": "Indicator", "id": "a41577c4-1c34-4ad4-a198-30b8a499f9e6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--84d55cc8-daf2-5c6b-bb17-1175ddedbafe", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.458Z", "created_at": "2026-09-25T22:30:42.593Z", "modified": "2026-09-25T22:30:42.906Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:42.906Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ca9c016b-f6e6-4d2b-8b68-d79738de3cf5", "from_id": "ca9c016b-f6e6-4d2b-8b68-d79738de3cf5", "from_name": null, "from_type": "Indicator", "id": "a47ab3d1-acbb-40b6-af83-16eef813e930", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--56debee2-3b10-577f-9acf-6236b90e8bc9", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.460Z", "created_at": "2026-09-25T22:30:43.283Z", "modified": "2026-09-25T22:30:43.800Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:43.800Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c18d5d31-aab6-42a0-b912-3ce011e6c24e", "from_id": "c18d5d31-aab6-42a0-b912-3ce011e6c24e", "from_name": null, "from_type": "Indicator", "id": "a4fdccd2-7070-47ae-82f9-eca7e0d28484", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--3ba2062e-2bda-555c-920c-63d4e019d187", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.471Z", "created_at": "2026-09-25T22:30:58.779Z", "modified": "2026-09-25T22:30:59.134Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:59.134Z" }, "description_available": false, "entity_type": "indicates", "fromId": "84559950-df7c-4b00-907f-b1211e4aab8c", "from_id": "84559950-df7c-4b00-907f-b1211e4aab8c", "from_name": null, "from_type": "Indicator", "id": "a81b20e8-eec5-4f9a-820d-92c1eee18117", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--7d10434e-9ade-5f54-a2a0-4e2ba1d8b7c6", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.417Z", "created_at": "2026-09-25T22:29:35.435Z", "modified": "2026-09-25T22:29:36.153Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:36.153Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9da135c1-b409-4440-b6e0-d32528759a4a", "from_id": "9da135c1-b409-4440-b6e0-d32528759a4a", "from_name": null, "from_type": "Indicator", "id": "a850137c-33f3-4bb8-acd7-590104d6cb0c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--7b6c0327-1cc8-598d-b63d-ed5a5515e919", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.428Z", "created_at": "2026-09-25T22:29:52.727Z", "modified": "2026-09-25T22:29:54.760Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:54.760Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3bd23086-a121-42e3-86f3-df0c8e9a8e10", "from_id": "3bd23086-a121-42e3-86f3-df0c8e9a8e10", "from_name": null, "from_type": "Indicator", "id": "a8c94d64-d1d9-4852-ad83-832cf58e0be7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--4453d984-7877-5449-aa86-2b31c19237d9", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.432Z", "created_at": "2026-09-25T22:30:14.509Z", "modified": "2026-09-25T22:30:16.838Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:16.838Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c221f609-d916-4df5-ac09-d5ede33723f2", "from_id": "c221f609-d916-4df5-ac09-d5ede33723f2", "from_name": null, "from_type": "Indicator", "id": "ae4ca4b3-57cf-486e-ba81-d8b18a577f1b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--4d3f4e83-6ab7-585e-b663-0dcb46f323bd", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.415Z", "created_at": "2026-09-25T22:29:35.297Z", "modified": "2026-09-25T22:29:35.886Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:35.886Z" }, "description_available": false, "entity_type": "indicates", "fromId": "89cabe93-9bc5-4fbd-ba8c-841cf092d466", "from_id": "89cabe93-9bc5-4fbd-ba8c-841cf092d466", "from_name": null, "from_type": "Indicator", "id": "b07c81d6-9ca1-4081-b868-a5d77b0bdc7f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--e0c9def3-c298-518f-965d-4af32bca5bcf", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.441Z", "created_at": "2026-09-25T22:30:24.921Z", "modified": "2026-09-25T22:30:25.269Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:25.269Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bba5193a-00ec-4425-a8d9-9c607b2c6a8e", "from_id": "bba5193a-00ec-4425-a8d9-9c607b2c6a8e", "from_name": null, "from_type": "Indicator", "id": "b1aa0320-60e7-4b7f-a321-beb87b978755", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--cc45b81e-5ad2-5add-9efe-6943ab100588", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.413Z", "created_at": "2026-09-25T22:29:32.535Z", "modified": "2026-09-25T22:29:33.023Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:33.023Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c98e33d4-4be3-4df9-a1c0-0998e52b60bf", "from_id": "c98e33d4-4be3-4df9-a1c0-0998e52b60bf", "from_name": null, "from_type": "Indicator", "id": "b275eb75-6e8a-452f-beff-333427a17810", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--dd269a15-6858-5a43-bc17-6bd67b4a4431", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.443Z", "created_at": "2026-09-25T22:30:27.633Z", "modified": "2026-09-25T22:30:28.113Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:28.113Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bba5193a-00ec-4425-a8d9-9c607b2c6a8e", "from_id": "bba5193a-00ec-4425-a8d9-9c607b2c6a8e", "from_name": null, "from_type": "Indicator", "id": "b51cc520-80d6-4dcd-bb6a-2eb9062f17fa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--df0b5ae5-b9f0-5e32-ba2d-9ca95257d379", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.450Z", "created_at": "2026-09-25T22:30:36.039Z", "modified": "2026-09-25T22:30:36.272Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:36.272Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7ce5d8d7-6f53-4f55-97a3-14ff6dcb1b33", "from_id": "7ce5d8d7-6f53-4f55-97a3-14ff6dcb1b33", "from_name": null, "from_type": "Indicator", "id": "b7c1d4a0-c76f-45b9-aaf5-41e673541b5e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--ed1d6d26-3082-553d-9ffc-50557e6baf03", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.432Z", "created_at": "2026-09-25T22:30:17.304Z", "modified": "2026-09-25T22:30:17.791Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:17.791Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c221f609-d916-4df5-ac09-d5ede33723f2", "from_id": "c221f609-d916-4df5-ac09-d5ede33723f2", "from_name": null, "from_type": "Indicator", "id": "b97bafa1-271c-4b64-b2d7-a10498170375", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--ffd2522d-43a6-5437-869e-355fe6ee280c", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.411Z", "created_at": "2026-09-25T22:29:26.279Z", "modified": "2026-09-25T22:29:26.634Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:26.634Z" }, "description_available": false, "entity_type": "indicates", "fromId": "10451f39-fc58-43f8-88a2-8abf495310f7", "from_id": "10451f39-fc58-43f8-88a2-8abf495310f7", "from_name": null, "from_type": "Indicator", "id": "ba51c7a2-a59b-458d-9337-f8e15409e48a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--51a4b3fd-4bea-57aa-bd4e-154afdca447c", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.464Z", "created_at": "2026-09-25T22:30:50.546Z", "modified": "2026-09-25T22:30:51.363Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:51.363Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7b2f25c0-f120-4c9a-a7b4-6a77250b0d00", "from_id": "7b2f25c0-f120-4c9a-a7b4-6a77250b0d00", "from_name": null, "from_type": "Indicator", "id": "beadde51-db53-41d9-980e-3efb48628d7c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--52b29906-74e1-5e5b-b175-8be2b6f13add", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.410Z", "created_at": "2026-09-25T22:29:24.908Z", "modified": "2026-09-25T22:29:25.352Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:25.352Z" }, "description_available": false, "entity_type": "indicates", "fromId": "10451f39-fc58-43f8-88a2-8abf495310f7", "from_id": "10451f39-fc58-43f8-88a2-8abf495310f7", "from_name": null, "from_type": "Indicator", "id": "c30baa09-bdc1-4134-a99f-b486fd09ca09", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--206a600d-2bb9-5864-8172-84d6d0fd9cfb", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.379Z", "created_at": "2026-09-25T22:28:17.060Z", "modified": "2026-09-25T22:28:19.714Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:28:19.714Z" }, "description_available": false, "entity_type": "based-on", "fromId": "a2550196-16e4-4f57-ba6f-fe19af53c1a5", "from_id": "a2550196-16e4-4f57-ba6f-fe19af53c1a5", "from_name": null, "from_type": "Indicator", "id": "c397459c-6dcd-485a-aad5-af00fe588056", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--d36c514f-37a7-51d2-ae89-7dc81771500a", "toId": "13695d3d-a83d-4cc0-b96f-45f529a545c8", "to_id": "13695d3d-a83d-4cc0-b96f-45f529a545c8", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.431Z", "created_at": "2026-09-25T22:30:01.228Z", "modified": "2026-09-25T22:30:11.837Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:11.837Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c221f609-d916-4df5-ac09-d5ede33723f2", "from_id": "c221f609-d916-4df5-ac09-d5ede33723f2", "from_name": null, "from_type": "Indicator", "id": "c3d84195-2495-4dc3-a9dc-c931f1600468", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--794bcefa-e88f-52b2-8406-54a8ed195683", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.409Z", "created_at": "2026-09-25T22:29:23.162Z", "modified": "2026-09-25T22:29:24.201Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:24.201Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7e4f8594-7b59-4e26-bf6d-0c20249f143e", "from_id": "7e4f8594-7b59-4e26-bf6d-0c20249f143e", "from_name": null, "from_type": "Indicator", "id": "c4c0f0e7-f77e-4641-89d9-3ee5021ed966", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--6b27436f-b5eb-5d90-a501-2fc430fed376", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.434Z", "created_at": "2026-09-25T22:30:19.613Z", "modified": "2026-09-25T22:30:20.180Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:20.180Z" }, "description_available": false, "entity_type": "indicates", "fromId": "229ac616-d04d-467c-85d3-b8054534e90f", "from_id": "229ac616-d04d-467c-85d3-b8054534e90f", "from_name": null, "from_type": "Indicator", "id": "c65a7fcd-9736-4771-a4e1-25763c1923df", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--bcd4e524-77c6-5dd2-af20-e88cd8814c82", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.360Z", "created_at": "2026-09-25T22:27:55.825Z", "modified": "2026-09-25T22:27:56.296Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:27:56.296Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c83a70a9-14a5-4be3-a28a-2b8cc677794c", "from_id": "c83a70a9-14a5-4be3-a28a-2b8cc677794c", "from_name": null, "from_type": "Indicator", "id": "c725e52b-88a7-4fba-96cb-6ac68f2fe687", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--b1eb3408-4e4f-5eaa-9dce-7b8343c638ad", "toId": "000aa249-6269-43ce-8c47-33d61906f640", "to_id": "000aa249-6269-43ce-8c47-33d61906f640", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.445Z", "created_at": "2026-09-25T22:30:27.955Z", "modified": "2026-09-25T22:30:28.281Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:28.281Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a170338f-18cb-4125-9ec4-0cb43af62760", "from_id": "a170338f-18cb-4125-9ec4-0cb43af62760", "from_name": null, "from_type": "Indicator", "id": "cc873a47-7b1b-4a9d-a7aa-95bfaf6d58b8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--9b6a3cae-70eb-5fb8-9157-e7b8ac6ed798", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.410Z", "created_at": "2026-09-25T22:29:28.487Z", "modified": "2026-09-25T22:29:29.154Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:29.154Z" }, "description_available": false, "entity_type": "indicates", "fromId": "10451f39-fc58-43f8-88a2-8abf495310f7", "from_id": "10451f39-fc58-43f8-88a2-8abf495310f7", "from_name": null, "from_type": "Indicator", "id": "cd47a82d-35b7-4d14-af1e-48d0772cca59", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--8e513119-6453-5971-8cc4-bc86d2b640cd", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.348Z", "created_at": "2026-09-25T22:27:54.310Z", "modified": "2026-09-25T22:27:54.820Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:27:54.820Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e009e973-4c8b-49df-8b5d-d18bcad29d6d", "from_id": "e009e973-4c8b-49df-8b5d-d18bcad29d6d", "from_name": null, "from_type": "Indicator", "id": "cdc51ccc-142d-4cac-a7dd-aba13837fc81", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--1ef47534-2abd-5c8e-a579-e169d64e4a66", "toId": "d763bb5a-6077-4d04-b554-cacd7c8e91f1", "to_id": "d763bb5a-6077-4d04-b554-cacd7c8e91f1", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.412Z", "created_at": "2026-09-25T22:29:28.407Z", "modified": "2026-09-25T22:29:29.153Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:29.153Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c98e33d4-4be3-4df9-a1c0-0998e52b60bf", "from_id": "c98e33d4-4be3-4df9-a1c0-0998e52b60bf", "from_name": null, "from_type": "Indicator", "id": "ce4b4959-5065-41ca-8e59-cfb4fbf744b8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--7b9d4c25-bf5e-5f38-bb90-7cfaed0f06a2", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.419Z", "created_at": "2026-09-25T22:29:39.575Z", "modified": "2026-09-25T22:29:40.331Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:40.331Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e009e973-4c8b-49df-8b5d-d18bcad29d6d", "from_id": "e009e973-4c8b-49df-8b5d-d18bcad29d6d", "from_name": null, "from_type": "Indicator", "id": "d19ea111-df97-4d6b-99e1-2480703223fc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--85695ec2-542b-5087-b3d9-71510b411728", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.419Z", "created_at": "2026-09-25T22:29:44.891Z", "modified": "2026-09-25T22:29:45.582Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:45.582Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e009e973-4c8b-49df-8b5d-d18bcad29d6d", "from_id": "e009e973-4c8b-49df-8b5d-d18bcad29d6d", "from_name": null, "from_type": "Indicator", "id": "d6b9c9ac-2e8b-42f9-9b3c-32cab0d6c45b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--506c0700-544e-58b2-9fb9-c1a99aad05a1", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.451Z", "created_at": "2026-09-25T22:30:34.606Z", "modified": "2026-09-25T22:30:34.864Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:34.864Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a606793c-2422-4ffb-adea-624f670f4f9a", "from_id": "a606793c-2422-4ffb-adea-624f670f4f9a", "from_name": null, "from_type": "Indicator", "id": "dadf2d06-ccac-407c-8f74-1d80d0dde4cf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--22a595df-dc31-527f-afea-0b32865eaf43", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.407Z", "created_at": "2026-09-25T22:29:12.013Z", "modified": "2026-09-25T22:29:15.568Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:15.568Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7e4f8594-7b59-4e26-bf6d-0c20249f143e", "from_id": "7e4f8594-7b59-4e26-bf6d-0c20249f143e", "from_name": null, "from_type": "Indicator", "id": "dcf1b38a-854d-4905-9de4-7c314edad588", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--dacbc479-72d6-531a-9cdb-f9b2076bd456", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.469Z", "created_at": "2026-09-25T22:30:57.323Z", "modified": "2026-09-25T22:30:57.797Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:57.797Z" }, "description_available": false, "entity_type": "indicates", "fromId": "dfe0c7a7-9c02-460c-b135-6ba74ffc888d", "from_id": "dfe0c7a7-9c02-460c-b135-6ba74ffc888d", "from_name": null, "from_type": "Indicator", "id": "e1ad202d-0cc9-4134-a414-385f8ce789c3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--dec56b89-5be2-51e3-ac4e-f8138f953b66", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.457Z", "created_at": "2026-09-25T22:30:41.241Z", "modified": "2026-09-25T22:30:41.918Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:41.918Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ca9c016b-f6e6-4d2b-8b68-d79738de3cf5", "from_id": "ca9c016b-f6e6-4d2b-8b68-d79738de3cf5", "from_name": null, "from_type": "Indicator", "id": "e21c30e6-741d-4406-a002-715316a21236", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--8d7f14b8-8606-5019-acf2-6b007f0ebd23", "toId": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "to_name": "THost4", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.414Z", "created_at": "2026-09-25T22:29:32.659Z", "modified": "2026-09-25T22:29:33.215Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:33.215Z" }, "description_available": false, "entity_type": "indicates", "fromId": "89cabe93-9bc5-4fbd-ba8c-841cf092d466", "from_id": "89cabe93-9bc5-4fbd-ba8c-841cf092d466", "from_name": null, "from_type": "Indicator", "id": "e337b1f4-8573-4780-83ce-ece8457c4d13", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--ee187cb5-1ba7-524c-9ad8-5f79e7041d38", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.334Z", "created_at": "2026-09-25T22:27:49.621Z", "modified": "2026-09-25T22:27:50.034Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:27:50.034Z" }, "description_available": false, "entity_type": "based-on", "fromId": "7e4f8594-7b59-4e26-bf6d-0c20249f143e", "from_id": "7e4f8594-7b59-4e26-bf6d-0c20249f143e", "from_name": null, "from_type": "Indicator", "id": "e4b852e1-c433-4098-b180-4a369ac3cd2c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--b3e25262-83e9-5467-b37f-5b556e403378", "toId": "f6d5cd19-7533-40cb-8138-23fef513afae", "to_id": "f6d5cd19-7533-40cb-8138-23fef513afae", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.358Z", "created_at": "2026-09-25T22:27:55.790Z", "modified": "2026-09-25T22:27:56.293Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:27:56.293Z" }, "description_available": false, "entity_type": "based-on", "fromId": "3bd23086-a121-42e3-86f3-df0c8e9a8e10", "from_id": "3bd23086-a121-42e3-86f3-df0c8e9a8e10", "from_name": null, "from_type": "Indicator", "id": "e50bcef5-820d-421e-9a6a-9cd0511a6fd3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--83989c15-a122-532f-bf2b-6ad1d6b286c1", "toId": "16cff726-e4e5-46e1-9268-1c38743320ae", "to_id": "16cff726-e4e5-46e1-9268-1c38743320ae", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.371Z", "created_at": "2026-09-25T22:28:09.345Z", "modified": "2026-09-25T22:28:11.649Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:28:11.649Z" }, "description_available": false, "entity_type": "based-on", "fromId": "bb9032ab-4f94-4206-b102-c24443d56c52", "from_id": "bb9032ab-4f94-4206-b102-c24443d56c52", "from_name": null, "from_type": "Indicator", "id": "e584478c-fe99-4697-b5e5-93de5b3af630", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--7622b10f-d9b6-5762-94d4-a60b16fcc0a9", "toId": "5cb05d64-6cf1-4365-9e5c-dbe2ab0af9d2", "to_id": "5cb05d64-6cf1-4365-9e5c-dbe2ab0af9d2", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.425Z", "created_at": "2026-09-25T22:29:48.740Z", "modified": "2026-09-25T22:29:49.350Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:49.350Z" }, "description_available": false, "entity_type": "indicates", "fromId": "92bd8bb3-bd42-4171-8545-933562aff4b4", "from_id": "92bd8bb3-bd42-4171-8545-933562aff4b4", "from_name": null, "from_type": "Indicator", "id": "e5d2acd9-0722-422d-98eb-ecf8f0dd44d6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--663ad5ba-6da7-553d-afa4-905ce348b02b", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.436Z", "created_at": "2026-09-25T22:30:20.441Z", "modified": "2026-09-25T22:30:20.829Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:20.829Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c69a8fcd-e003-41dd-888a-12fb2c7c30fe", "from_id": "c69a8fcd-e003-41dd-888a-12fb2c7c30fe", "from_name": null, "from_type": "Indicator", "id": "e686fd52-4a55-41f8-b13d-7bc9c2e9ecc8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--3a3ebaac-6637-5b7a-8bfc-ca42adafeeb0", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.442Z", "created_at": "2026-09-25T22:30:25.788Z", "modified": "2026-09-25T22:30:26.234Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:26.234Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bba5193a-00ec-4425-a8d9-9c607b2c6a8e", "from_id": "bba5193a-00ec-4425-a8d9-9c607b2c6a8e", "from_name": null, "from_type": "Indicator", "id": "e88bf6f0-0f2a-40cc-a627-d3d9b6929893", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--84449191-3b51-5f03-8df3-b25b70ae2bbe", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.420Z", "created_at": "2026-09-25T22:29:41.002Z", "modified": "2026-09-25T22:29:41.517Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:41.517Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e009e973-4c8b-49df-8b5d-d18bcad29d6d", "from_id": "e009e973-4c8b-49df-8b5d-d18bcad29d6d", "from_name": null, "from_type": "Indicator", "id": "e8c7763b-bcfc-4772-878b-bb274743e2b0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--5f57d0d5-cd7d-5e0d-b3e5-64264e75e60f", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.421Z", "created_at": "2026-09-25T22:29:41.006Z", "modified": "2026-09-25T22:29:41.518Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:41.518Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6a090dbe-89be-427d-b357-543592b728c4", "from_id": "6a090dbe-89be-427d-b357-543592b728c4", "from_name": null, "from_type": "Indicator", "id": "ebfea58b-634f-4e8e-a139-e7ebbe80f9fb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--5adcb889-27ab-5123-b572-185483e742df", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.453Z", "created_at": "2026-09-25T22:30:36.534Z", "modified": "2026-09-25T22:30:37.172Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:37.172Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a606793c-2422-4ffb-adea-624f670f4f9a", "from_id": "a606793c-2422-4ffb-adea-624f670f4f9a", "from_name": null, "from_type": "Indicator", "id": "ec9d5e71-2751-4464-87c6-6f0266830e60", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--1efa74bc-d127-5439-b242-254cd4c98309", "toId": "1d056287-b471-446a-8f47-c51780004af3", "to_id": "1d056287-b471-446a-8f47-c51780004af3", "to_name": "tc9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.346Z", "created_at": "2026-09-25T22:27:52.126Z", "modified": "2026-09-25T22:27:54.386Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:27:54.386Z" }, "description_available": false, "entity_type": "based-on", "fromId": "9da135c1-b409-4440-b6e0-d32528759a4a", "from_id": "9da135c1-b409-4440-b6e0-d32528759a4a", "from_name": null, "from_type": "Indicator", "id": "ee663474-6d90-446b-bc8b-2ab536a01408", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--de44a10c-fc90-5696-8d4a-685bb7578bc6", "toId": "4b14a071-e993-459d-b755-fac8c2b25693", "to_id": "4b14a071-e993-459d-b755-fac8c2b25693", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.407Z", "created_at": "2026-09-25T22:29:12.006Z", "modified": "2026-09-25T22:29:15.569Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:15.569Z" }, "description_available": false, "entity_type": "based-on", "fromId": "6c98d07d-b770-4a45-9ae0-047940d0dacf", "from_id": "6c98d07d-b770-4a45-9ae0-047940d0dacf", "from_name": null, "from_type": "Indicator", "id": "efd601c1-114e-4295-8393-1c50a8e16445", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--76aef34b-6e72-5c60-951c-9521391928d5", "toId": "0b70a919-7001-4ddc-a6d9-fa913e499f51", "to_id": "0b70a919-7001-4ddc-a6d9-fa913e499f51", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.374Z", "created_at": "2026-09-25T22:28:09.345Z", "modified": "2026-09-25T22:28:11.651Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:28:11.651Z" }, "description_available": false, "entity_type": "based-on", "fromId": "bba5193a-00ec-4425-a8d9-9c607b2c6a8e", "from_id": "bba5193a-00ec-4425-a8d9-9c607b2c6a8e", "from_name": null, "from_type": "Indicator", "id": "f2939529-1d69-4a29-8e1b-c6d3eb9365a9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--a15f76f6-0ed4-5573-8777-d09c83c25f92", "toId": "2a9e21f9-ba9c-41c8-8b2f-080d9c9e47a2", "to_id": "2a9e21f9-ba9c-41c8-8b2f-080d9c9e47a2", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.473Z", "created_at": "2026-09-25T22:30:59.442Z", "modified": "2026-09-25T22:30:59.661Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:59.661Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6c98d07d-b770-4a45-9ae0-047940d0dacf", "from_id": "6c98d07d-b770-4a45-9ae0-047940d0dacf", "from_name": null, "from_type": "Indicator", "id": "f6047837-99d1-42f5-b110-dac79732d3d0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--3ee6a4d1-38e2-5d25-b46a-89bda135184a", "toId": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "to_name": "THost9", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.400Z", "created_at": "2026-09-25T22:28:56.896Z", "modified": "2026-09-25T22:29:08.687Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:08.687Z" }, "description_available": false, "entity_type": "based-on", "fromId": "9e98c83e-927c-4999-a139-eb2f7f0c07f4", "from_id": "9e98c83e-927c-4999-a139-eb2f7f0c07f4", "from_name": null, "from_type": "Indicator", "id": "f70108ca-9988-426d-a0d1-cb72c5b44d9d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--397b3f8d-8ec9-5d9a-8c70-e6757bf68301", "toId": "014eb6cb-b65e-43bc-8a2f-fd7e1011731f", "to_id": "014eb6cb-b65e-43bc-8a2f-fd7e1011731f", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.433Z", "created_at": "2026-09-25T22:30:17.558Z", "modified": "2026-09-25T22:30:17.982Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:17.982Z" }, "description_available": false, "entity_type": "indicates", "fromId": "229ac616-d04d-467c-85d3-b8054534e90f", "from_id": "229ac616-d04d-467c-85d3-b8054534e90f", "from_name": null, "from_type": "Indicator", "id": "f794421c-ecb0-4cf5-88bf-2b3385824b8f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--334f0e07-6597-5be6-8665-60bb6aa33146", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.418Z", "created_at": "2026-09-25T22:29:36.889Z", "modified": "2026-09-25T22:29:37.243Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:29:37.243Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e009e973-4c8b-49df-8b5d-d18bcad29d6d", "from_id": "e009e973-4c8b-49df-8b5d-d18bcad29d6d", "from_name": null, "from_type": "Indicator", "id": "f9634555-29f8-4a0c-8a44-1810a13507ac", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--9bbf5c41-c35c-514f-92e4-75047a04321f", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.365Z", "created_at": "2026-09-25T22:27:58.384Z", "modified": "2026-09-25T22:28:03.682Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:28:03.682Z" }, "description_available": false, "entity_type": "based-on", "fromId": "229ac616-d04d-467c-85d3-b8054534e90f", "from_id": "229ac616-d04d-467c-85d3-b8054534e90f", "from_name": null, "from_type": "Indicator", "id": "fb891fbf-828c-4076-bc20-9d208af64535", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--44f5d0e5-b627-5b14-bd99-a355160d0a07", "toId": "c8a9c76e-ee67-4ec3-a38d-c4478935ba86", "to_id": "c8a9c76e-ee67-4ec3-a38d-c4478935ba86", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.456Z", "created_at": "2026-09-25T22:30:38.628Z", "modified": "2026-09-25T22:30:39.005Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:39.005Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ca9c016b-f6e6-4d2b-8b68-d79738de3cf5", "from_id": "ca9c016b-f6e6-4d2b-8b68-d79738de3cf5", "from_name": null, "from_type": "Indicator", "id": "fc92fe6d-dd97-494d-9d0f-973f585a246c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--c96b5b2d-588a-5391-9d18-76dff8bbbd6a", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:51:17.459Z", "created_at": "2026-09-25T22:30:41.942Z", "modified": "2026-09-25T22:30:42.667Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T22:30:42.667Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c18d5d31-aab6-42a0-b912-3ce011e6c24e", "from_id": "c18d5d31-aab6-42a0-b912-3ce011e6c24e", "from_name": null, "from_type": "Indicator", "id": "fcf45ce7-5dde-480f-8bac-c1e84e944023", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "standard_id": "relationship--349831d3-b043-53b9-89a9-25b66781476f", "toId": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "to_name": "Hagaseca", "to_type": "Malware" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hagaseca[.]com", "description_available": false, "object_id": "10451f39-fc58-43f8-88a2-8abf495310f7", "object_ids": [ "10451f39-fc58-43f8-88a2-8abf495310f7", "df431b55-7856-4813-abb8-556edb5f7d27" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "10451f39-fc58-43f8-88a2-8abf495310f7", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2026-12-20T07:54:18.260Z", "validity_status": "active", "value": "hagaseca.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "df431b55-7856-4813-abb8-556edb5f7d27", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "hagaseca.com" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "domain", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2026-12-20T07:54:18.260Z", "validity_status": "active", "value": "hagaseca.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hagaseca[.]ec", "description_available": false, "object_id": "dfe0c7a7-9c02-460c-b135-6ba74ffc888d", "object_ids": [ "d4a1e657-9419-4204-947a-b5b0080ea28d", "dfe0c7a7-9c02-460c-b135-6ba74ffc888d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "dfe0c7a7-9c02-460c-b135-6ba74ffc888d", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2026-12-20T07:54:18.260Z", "validity_status": "active", "value": "hagaseca.ec" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "d4a1e657-9419-4204-947a-b5b0080ea28d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "hagaseca.ec" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "domain", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2026-12-20T07:54:18.260Z", "validity_status": "active", "value": "hagaseca.ec" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "79[.]110[.]49[.]156", "description_available": false, "object_id": "ca9c016b-f6e6-4d2b-8b68-d79738de3cf5", "object_ids": [ "701e361d-703f-4d87-b07b-c8aa4623cbcf", "ca9c016b-f6e6-4d2b-8b68-d79738de3cf5" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ca9c016b-f6e6-4d2b-8b68-d79738de3cf5", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2026-09-28T22:33:49.434Z", "validity_status": "revoked", "value": "79.110.49.156" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "701e361d-703f-4d87-b07b-c8aa4623cbcf", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "79.110.49.156" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "ipv4", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2026-09-28T22:33:49.434Z", "validity_status": "revoked", "value": "79.110.49.156" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "24f344e174546e780332d573d5a27c43", "description_available": false, "object_id": "e009e973-4c8b-49df-8b5d-d18bcad29d6d", "object_ids": [ "d763bb5a-6077-4d04-b554-cacd7c8e91f1", "e009e973-4c8b-49df-8b5d-d18bcad29d6d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e009e973-4c8b-49df-8b5d-d18bcad29d6d", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "24f344e174546e780332d573d5a27c43" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "d763bb5a-6077-4d04-b554-cacd7c8e91f1", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "24f344e174546e780332d573d5a27c43" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "md5", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "24f344e174546e780332d573d5a27c43" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "bdca0eb738faaccb5b992d0f393b9d9f", "description_available": false, "object_id": "c98e33d4-4be3-4df9-a1c0-0998e52b60bf", "object_ids": [ "0233b2d0-1212-4fe0-8eda-28370a757273", "c98e33d4-4be3-4df9-a1c0-0998e52b60bf" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c98e33d4-4be3-4df9-a1c0-0998e52b60bf", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "bdca0eb738faaccb5b992d0f393b9d9f" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "0233b2d0-1212-4fe0-8eda-28370a757273", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "bdca0eb738faaccb5b992d0f393b9d9f" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "md5", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "bdca0eb738faaccb5b992d0f393b9d9f" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "dfd9c7dee4f4a16d636917de35a510b7", "description_available": false, "object_id": "6a090dbe-89be-427d-b357-543592b728c4", "object_ids": [ "6a090dbe-89be-427d-b357-543592b728c4", "6d7a7821-cf92-497c-9a11-ee6318b62d7b" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "6a090dbe-89be-427d-b357-543592b728c4", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "dfd9c7dee4f4a16d636917de35a510b7" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "6d7a7821-cf92-497c-9a11-ee6318b62d7b", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "dfd9c7dee4f4a16d636917de35a510b7" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "md5", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "dfd9c7dee4f4a16d636917de35a510b7" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "03fc9c35d6453ccf7dd5d16ea2d6d272da1e1cae", "description_available": false, "object_id": "92bd8bb3-bd42-4171-8545-933562aff4b4", "object_ids": [ "92bd8bb3-bd42-4171-8545-933562aff4b4", "a86ca6f3-c98c-423b-a243-e2c2bc9e26d1" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "92bd8bb3-bd42-4171-8545-933562aff4b4", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "03fc9c35d6453ccf7dd5d16ea2d6d272da1e1cae" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "a86ca6f3-c98c-423b-a243-e2c2bc9e26d1", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "03fc9c35d6453ccf7dd5d16ea2d6d272da1e1cae" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "sha1", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "03fc9c35d6453ccf7dd5d16ea2d6d272da1e1cae" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "3a8138debf528361bf7093e3aa85a5f84105ebf6", "description_available": false, "object_id": "3bd23086-a121-42e3-86f3-df0c8e9a8e10", "object_ids": [ "16cff726-e4e5-46e1-9268-1c38743320ae", "3bd23086-a121-42e3-86f3-df0c8e9a8e10" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "3bd23086-a121-42e3-86f3-df0c8e9a8e10", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "3a8138debf528361bf7093e3aa85a5f84105ebf6" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "16cff726-e4e5-46e1-9268-1c38743320ae", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "3a8138debf528361bf7093e3aa85a5f84105ebf6" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "sha1", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "3a8138debf528361bf7093e3aa85a5f84105ebf6" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "8e2a4186103443e05f57d6607969ebba953a16f4", "description_available": false, "object_id": "7b2f25c0-f120-4c9a-a7b4-6a77250b0d00", "object_ids": [ "7b2f25c0-f120-4c9a-a7b4-6a77250b0d00", "ef9e1a88-8647-41fb-ae93-f688003f88e8" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "7b2f25c0-f120-4c9a-a7b4-6a77250b0d00", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "8e2a4186103443e05f57d6607969ebba953a16f4" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "ef9e1a88-8647-41fb-ae93-f688003f88e8", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "8e2a4186103443e05f57d6607969ebba953a16f4" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "sha1", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "8e2a4186103443e05f57d6607969ebba953a16f4" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "962add498857e2497bb9b720528cc6a687a5db07", "description_available": false, "object_id": "9e98c83e-927c-4999-a139-eb2f7f0c07f4", "object_ids": [ "014eb6cb-b65e-43bc-8a2f-fd7e1011731f", "9e98c83e-927c-4999-a139-eb2f7f0c07f4" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "9e98c83e-927c-4999-a139-eb2f7f0c07f4", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "962add498857e2497bb9b720528cc6a687a5db07" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "014eb6cb-b65e-43bc-8a2f-fd7e1011731f", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "962add498857e2497bb9b720528cc6a687a5db07" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "sha1", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "962add498857e2497bb9b720528cc6a687a5db07" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "c6ee3d72053772bdce063c5b98afe32e739e918e", "description_available": false, "object_id": "89cabe93-9bc5-4fbd-ba8c-841cf092d466", "object_ids": [ "79a24f04-8a9c-4517-8e68-93c2af71129c", "89cabe93-9bc5-4fbd-ba8c-841cf092d466" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "89cabe93-9bc5-4fbd-ba8c-841cf092d466", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "c6ee3d72053772bdce063c5b98afe32e739e918e" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "79a24f04-8a9c-4517-8e68-93c2af71129c", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "c6ee3d72053772bdce063c5b98afe32e739e918e" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "sha1", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "c6ee3d72053772bdce063c5b98afe32e739e918e" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "05e26b639f55e53f73c2fd2980c519db347086951d832d58a94a26990d81befe", "description_available": false, "object_id": "c83a70a9-14a5-4be3-a28a-2b8cc677794c", "object_ids": [ "000aa249-6269-43ce-8c47-33d61906f640", "c83a70a9-14a5-4be3-a28a-2b8cc677794c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c83a70a9-14a5-4be3-a28a-2b8cc677794c", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "05e26b639f55e53f73c2fd2980c519db347086951d832d58a94a26990d81befe" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "000aa249-6269-43ce-8c47-33d61906f640", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "05e26b639f55e53f73c2fd2980c519db347086951d832d58a94a26990d81befe" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "sha256", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "05e26b639f55e53f73c2fd2980c519db347086951d832d58a94a26990d81befe" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "12fb8fe6cd895044e38217dd5945b0ec810f667660fd87dbb21687ea42084589", "description_available": false, "object_id": "c221f609-d916-4df5-ac09-d5ede33723f2", "object_ids": [ "552a783a-2e40-4016-9e50-c1fb368fad40", "c221f609-d916-4df5-ac09-d5ede33723f2" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c221f609-d916-4df5-ac09-d5ede33723f2", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "12fb8fe6cd895044e38217dd5945b0ec810f667660fd87dbb21687ea42084589" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "552a783a-2e40-4016-9e50-c1fb368fad40", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "12fb8fe6cd895044e38217dd5945b0ec810f667660fd87dbb21687ea42084589" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "sha256", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "12fb8fe6cd895044e38217dd5945b0ec810f667660fd87dbb21687ea42084589" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "16c3ee7276d52c11d3cc6270af883abe5d7015ea4f8f66fb3b6493144a863377", "description_available": false, "object_id": "229ac616-d04d-467c-85d3-b8054534e90f", "object_ids": [ "229ac616-d04d-467c-85d3-b8054534e90f", "c8a9c76e-ee67-4ec3-a38d-c4478935ba86" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "229ac616-d04d-467c-85d3-b8054534e90f", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "16c3ee7276d52c11d3cc6270af883abe5d7015ea4f8f66fb3b6493144a863377" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "c8a9c76e-ee67-4ec3-a38d-c4478935ba86", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "16c3ee7276d52c11d3cc6270af883abe5d7015ea4f8f66fb3b6493144a863377" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "sha256", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "16c3ee7276d52c11d3cc6270af883abe5d7015ea4f8f66fb3b6493144a863377" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "1e6ff4a1dba4d6e4c29f4f7bc06b774104a38c181a05ebed127bb7b914128a21", "description_available": false, "object_id": "c69a8fcd-e003-41dd-888a-12fb2c7c30fe", "object_ids": [ "63b2c2d6-f10c-4e22-a5e5-003ac04020bc", "c69a8fcd-e003-41dd-888a-12fb2c7c30fe" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c69a8fcd-e003-41dd-888a-12fb2c7c30fe", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "1e6ff4a1dba4d6e4c29f4f7bc06b774104a38c181a05ebed127bb7b914128a21" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "63b2c2d6-f10c-4e22-a5e5-003ac04020bc", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "1e6ff4a1dba4d6e4c29f4f7bc06b774104a38c181a05ebed127bb7b914128a21" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "sha256", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "1e6ff4a1dba4d6e4c29f4f7bc06b774104a38c181a05ebed127bb7b914128a21" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "30f4e1bc0cd96d4210765b18533eb0c5343f155a36b1a567132538242487d09c", "description_available": false, "object_id": "bb9032ab-4f94-4206-b102-c24443d56c52", "object_ids": [ "5cb05d64-6cf1-4365-9e5c-dbe2ab0af9d2", "bb9032ab-4f94-4206-b102-c24443d56c52" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "bb9032ab-4f94-4206-b102-c24443d56c52", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "30f4e1bc0cd96d4210765b18533eb0c5343f155a36b1a567132538242487d09c" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "5cb05d64-6cf1-4365-9e5c-dbe2ab0af9d2", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "30f4e1bc0cd96d4210765b18533eb0c5343f155a36b1a567132538242487d09c" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "sha256", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "30f4e1bc0cd96d4210765b18533eb0c5343f155a36b1a567132538242487d09c" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "45f71eb7ee96f80a1e865b2249452b603b729f4fc4c6f02ed00cadcdacf8f384", "description_available": false, "object_id": "bba5193a-00ec-4425-a8d9-9c607b2c6a8e", "object_ids": [ "2a9e21f9-ba9c-41c8-8b2f-080d9c9e47a2", "bba5193a-00ec-4425-a8d9-9c607b2c6a8e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "bba5193a-00ec-4425-a8d9-9c607b2c6a8e", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "45f71eb7ee96f80a1e865b2249452b603b729f4fc4c6f02ed00cadcdacf8f384" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "2a9e21f9-ba9c-41c8-8b2f-080d9c9e47a2", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "45f71eb7ee96f80a1e865b2249452b603b729f4fc4c6f02ed00cadcdacf8f384" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "sha256", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "45f71eb7ee96f80a1e865b2249452b603b729f4fc4c6f02ed00cadcdacf8f384" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "54d4ee85175a249dcb576716edf491d09fa05dfdfc492ff710a0cb711f9a35ab", "description_available": false, "object_id": "9da135c1-b409-4440-b6e0-d32528759a4a", "object_ids": [ "4b14a071-e993-459d-b755-fac8c2b25693", "9da135c1-b409-4440-b6e0-d32528759a4a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "9da135c1-b409-4440-b6e0-d32528759a4a", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "54d4ee85175a249dcb576716edf491d09fa05dfdfc492ff710a0cb711f9a35ab" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "4b14a071-e993-459d-b755-fac8c2b25693", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "54d4ee85175a249dcb576716edf491d09fa05dfdfc492ff710a0cb711f9a35ab" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "sha256", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "54d4ee85175a249dcb576716edf491d09fa05dfdfc492ff710a0cb711f9a35ab" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "5652e2256df133a429f329ba60fe78c67ce63e089a5a3d58e4ff3d058ef7a708", "description_available": false, "object_id": "a170338f-18cb-4125-9ec4-0cb43af62760", "object_ids": [ "8dd66ad3-70bc-4e17-ba3e-b6f69211d15e", "a170338f-18cb-4125-9ec4-0cb43af62760" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "a170338f-18cb-4125-9ec4-0cb43af62760", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "5652e2256df133a429f329ba60fe78c67ce63e089a5a3d58e4ff3d058ef7a708" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "8dd66ad3-70bc-4e17-ba3e-b6f69211d15e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "5652e2256df133a429f329ba60fe78c67ce63e089a5a3d58e4ff3d058ef7a708" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "sha256", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "5652e2256df133a429f329ba60fe78c67ce63e089a5a3d58e4ff3d058ef7a708" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "7ec965cd61ad4de270b45e7719fdd72b3a37b27c0ba5764a73ec2c1cfc966559", "description_available": false, "object_id": "a2550196-16e4-4f57-ba6f-fe19af53c1a5", "object_ids": [ "13695d3d-a83d-4cc0-b96f-45f529a545c8", "a2550196-16e4-4f57-ba6f-fe19af53c1a5" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "a2550196-16e4-4f57-ba6f-fe19af53c1a5", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "7ec965cd61ad4de270b45e7719fdd72b3a37b27c0ba5764a73ec2c1cfc966559" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "13695d3d-a83d-4cc0-b96f-45f529a545c8", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "7ec965cd61ad4de270b45e7719fdd72b3a37b27c0ba5764a73ec2c1cfc966559" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "sha256", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "7ec965cd61ad4de270b45e7719fdd72b3a37b27c0ba5764a73ec2c1cfc966559" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "9cd3a954e807a3d596401b43e8820ca6ee76119d4dfc60afe0eaaf054e2c2ab5", "description_available": false, "object_id": "7ce5d8d7-6f53-4f55-97a3-14ff6dcb1b33", "object_ids": [ "7ce5d8d7-6f53-4f55-97a3-14ff6dcb1b33", "85271749-9946-44a0-8b94-c9d9fdccc31e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "7ce5d8d7-6f53-4f55-97a3-14ff6dcb1b33", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "9cd3a954e807a3d596401b43e8820ca6ee76119d4dfc60afe0eaaf054e2c2ab5" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "85271749-9946-44a0-8b94-c9d9fdccc31e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "9cd3a954e807a3d596401b43e8820ca6ee76119d4dfc60afe0eaaf054e2c2ab5" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "sha256", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "9cd3a954e807a3d596401b43e8820ca6ee76119d4dfc60afe0eaaf054e2c2ab5" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "b32bfa02834d43f04b78854e6cc417da2d45a2ca6d2908f33c06dc97c7cc0389", "description_available": false, "object_id": "a606793c-2422-4ffb-adea-624f670f4f9a", "object_ids": [ "805f8290-889a-4eb5-b65f-224fbf3ae9cc", "a606793c-2422-4ffb-adea-624f670f4f9a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "a606793c-2422-4ffb-adea-624f670f4f9a", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "b32bfa02834d43f04b78854e6cc417da2d45a2ca6d2908f33c06dc97c7cc0389" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "805f8290-889a-4eb5-b65f-224fbf3ae9cc", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "b32bfa02834d43f04b78854e6cc417da2d45a2ca6d2908f33c06dc97c7cc0389" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "sha256", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "b32bfa02834d43f04b78854e6cc417da2d45a2ca6d2908f33c06dc97c7cc0389" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "dfd708b9debd3c32897b96726a5a9437bcb36f1ad59639f1214a969f8f09e237", "description_available": false, "object_id": "df185928-e109-4e43-900e-3bd21c66eb82", "object_ids": [ "1d7e80f9-ca1a-42d9-aa09-b75a5fc31f5d", "df185928-e109-4e43-900e-3bd21c66eb82" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "df185928-e109-4e43-900e-3bd21c66eb82", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "dfd708b9debd3c32897b96726a5a9437bcb36f1ad59639f1214a969f8f09e237" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "1d7e80f9-ca1a-42d9-aa09-b75a5fc31f5d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "dfd708b9debd3c32897b96726a5a9437bcb36f1ad59639f1214a969f8f09e237" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "sha256", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2027-06-26T04:08:54.557Z", "validity_status": "active", "value": "dfd708b9debd3c32897b96726a5a9437bcb36f1ad59639f1214a969f8f09e237" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//hagaseca[.]pleasedonthackmyserver[.]com/hagaseca/gta", "description_available": false, "object_id": "c18d5d31-aab6-42a0-b912-3ce011e6c24e", "object_ids": [ "9c61aa7a-d418-4ca3-b275-6194691bcc13", "c18d5d31-aab6-42a0-b912-3ce011e6c24e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c18d5d31-aab6-42a0-b912-3ce011e6c24e", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2026-09-28T22:33:49.434Z", "validity_status": "revoked", "value": "http://hagaseca.pleasedonthackmyserver.com/hagaseca/gta" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "9c61aa7a-d418-4ca3-b275-6194691bcc13", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://hagaseca.pleasedonthackmyserver.com/hagaseca/gta" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "url", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2026-09-28T22:33:49.434Z", "validity_status": "revoked", "value": "http://hagaseca.pleasedonthackmyserver.com/hagaseca/gta" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//api[.]ipapi[.]is", "description_available": false, "object_id": "7e4f8594-7b59-4e26-bf6d-0c20249f143e", "object_ids": [ "7e4f8594-7b59-4e26-bf6d-0c20249f143e", "f6d5cd19-7533-40cb-8138-23fef513afae" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "7e4f8594-7b59-4e26-bf6d-0c20249f143e", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2026-09-28T22:33:49.434Z", "validity_status": "revoked", "value": "https://api.ipapi.is" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "f6d5cd19-7533-40cb-8138-23fef513afae", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://api.ipapi.is" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "url", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2026-09-28T22:33:49.434Z", "validity_status": "revoked", "value": "https://api.ipapi.is" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//test[.]hagaseca[.]com/ws", "description_available": false, "object_id": "87e06cbe-a9ad-439a-bfb8-1fd13fda476d", "object_ids": [ "025266ca-c80e-4e24-9e25-a64cbc668121", "87e06cbe-a9ad-439a-bfb8-1fd13fda476d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "87e06cbe-a9ad-439a-bfb8-1fd13fda476d", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2026-09-28T22:33:49.434Z", "validity_status": "revoked", "value": "https://test.hagaseca.com/ws" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "025266ca-c80e-4e24-9e25-a64cbc668121", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://test.hagaseca.com/ws" } ], "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader", "type": "url", "valid_from": "2026-09-08T16:59:10.000Z", "valid_until": "2026-09-28T22:33:49.434Z", "validity_status": "revoked", "value": "https://test.hagaseca.com/ws" } ], "mentioned": [ { "confidence": 50, "evidence_id": "cf198393-b77f-42ed-874d-4cefde8a58aa", "name": "Hagaseca", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "f5000074-f14f-4f33-9fd3-fad2646e8746", "name": "THost4", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "c9d61433-647e-4d2a-971b-1ca7d1e1f6d1", "name": "THost9", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "1d056287-b471-446a-8f47-c51780004af3", "name": "tc9", "role": "mentionné", "type": "Malware" } ], "mitre": { "associated_repertoire": [], "direct_techniques": [] }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-08T16:59:09.343Z", "created_at": "2026-09-25T22:31:01.764Z", "modified": "2026-09-25T22:31:03.515Z", "published": "2026-09-08T16:59:09.343Z", "updated_at": "2026-09-25T22:31:03.515Z" }, "description_available": true, "id": "ea37eb9c-02cd-4505-8443-800702dfe707", "is_inferred": false, "labels": [ "accessibility abuse", "adb propagation", "android rat", "hagaseca", "redroid", "tc9", "tc9.dex", "thost4", "thost9", "worm behavior" ], "lang": "en", "name": "Inside a Packed Android RAT Loader", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-08T16:59:09.343Z", "references": [ { "external_id": null, "id": "2709bf0d-c8e7-4b7a-8ebb-76d50bd1cb1d", "source_name": "alien-vault", "url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader" }, { "external_id": "6aa03edd0fe4e4f76a331977", "id": "024bd982-1dcd-43b5-9603-05209535f3cc", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6aa03edd0fe4e4f76a331977" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader" }, "targets": [], "techniques": [], "vulnerabilities": [] }, "report_id": "ea37eb9c-02cd-4505-8443-800702dfe707", "schema_version": 1, "selected_date": "2026-09-08", "source_url": "https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader" }