IOC du rapport source : https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader
Affichage neutralisé. Un observable associé n'est pas une preuve de compromission ni une consigne de blocage.
domain	hagaseca[.]com	active
domain	hagaseca[.]ec	active
ipv4	79[.]110[.]49[.]156	revoked
md5	24f344e174546e780332d573d5a27c43	active
md5	bdca0eb738faaccb5b992d0f393b9d9f	active
md5	dfd9c7dee4f4a16d636917de35a510b7	active
sha1	03fc9c35d6453ccf7dd5d16ea2d6d272da1e1cae	active
sha1	3a8138debf528361bf7093e3aa85a5f84105ebf6	active
sha1	8e2a4186103443e05f57d6607969ebba953a16f4	active
sha1	962add498857e2497bb9b720528cc6a687a5db07	active
sha1	c6ee3d72053772bdce063c5b98afe32e739e918e	active
sha256	05e26b639f55e53f73c2fd2980c519db347086951d832d58a94a26990d81befe	active
sha256	12fb8fe6cd895044e38217dd5945b0ec810f667660fd87dbb21687ea42084589	active
sha256	16c3ee7276d52c11d3cc6270af883abe5d7015ea4f8f66fb3b6493144a863377	active
sha256	1e6ff4a1dba4d6e4c29f4f7bc06b774104a38c181a05ebed127bb7b914128a21	active
sha256	30f4e1bc0cd96d4210765b18533eb0c5343f155a36b1a567132538242487d09c	active
sha256	45f71eb7ee96f80a1e865b2249452b603b729f4fc4c6f02ed00cadcdacf8f384	active
sha256	54d4ee85175a249dcb576716edf491d09fa05dfdfc492ff710a0cb711f9a35ab	active
sha256	5652e2256df133a429f329ba60fe78c67ce63e089a5a3d58e4ff3d058ef7a708	active
sha256	7ec965cd61ad4de270b45e7719fdd72b3a37b27c0ba5764a73ec2c1cfc966559	active
sha256	9cd3a954e807a3d596401b43e8820ca6ee76119d4dfc60afe0eaaf054e2c2ab5	active
sha256	b32bfa02834d43f04b78854e6cc417da2d45a2ca6d2908f33c06dc97c7cc0389	active
sha256	dfd708b9debd3c32897b96726a5a9437bcb36f1ad59639f1214a969f8f09e237	active
url	hxxp[:]//hagaseca[.]pleasedonthackmyserver[.]com/hagaseca/gta	revoked
url	hxxps[:]//api[.]ipapi[.]is	revoked
url	hxxps[:]//test[.]hagaseca[.]com/ws	revoked