181a75348ef246208b390b15139dd6acd2304d285ce7c6621e93cf77192dfc09

Analysis

max time kernel
149s
max time network
152s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
20/07/2026, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
king7hub.apk
Size 10.8MB
Sample260720-sg3jhsfz4x
SHA256 181a75348ef246208b390b15139dd6acd2304d285ce7c6621e93cf77192dfc09
MD5 acd47a725e6d7f28202198f484168943
SHA1 82e615b20f64b5c22989c0c6ab03f080adfab6e1
SHA512 a7cfdabee41cf9dd7baf00f4da6abcb1329ae44c9346d0e390a40b9db8541cc6b544773a2c56c228c1dc44f1374fcb43e14364f4b67ffc25626f093bcfd04958
SSDEEP 196608:kJ7Ch9/Jk12BQah12BQaJyxQ7EhAJZBHkGgvEhvu7gk2jIrj365xxL5xPGYXu:kJyhBrOBrJn4yTNm50+SxLfP8
TLSH
T184B62381FBD8EC1FCC73803247A21676864A4C9AD782E38B5914B26C58B7AD44FD5FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.king7hub
/data/local/xbin/su	com.king7hub
/data/local/bin/su	com.king7hub
/system/sd/xbin/su	com.king7hub
/system/bin/failsafe/su	com.king7hub
/system/bin/su	com.king7hub
/system/xbin/su	com.king7hub
/data/local/su	com.king7hub

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.king7hub

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.king7hub

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.king7hub

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.king7hub

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.king7hub

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.king7hub

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.king7hub

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.king7hub

com.king7hub
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:5092

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

OneSignal.db

Path /data/data/com.king7hub/databases/OneSignal.db
Size 52KB
SHA256 ab03de5564295f5ec34e2fccba9811cff818911b07798e9e456a58309deeb3a7
MD5 e1941e84ac2269c7b1b8bb7041b14001
SHA1 aed569ddb068a94e893702c297683c233d841f6f
SHA512 99124fc5347f6a7e19e0e30330c4e2f0f2d9074a0fc6a0ab7be25c5bd90d8dfdc66e8abeb1852be871dadb7a5945d7046d2e72ffb4f179c385ed7ffded33c2b7
SSDEEP 24:TLLSRZBUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvJqrEqjUix5+xGTrOPjwV+x:TeAcrA0oJxqrKcrObMoOS
TLSH
T11E338BCF4A862191EFC765B3155252E44E3B610E889317A63BF760245E83B16D72387C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.king7hub/databases/OneSignal.db-journal
Size 8KB
SHA256 4d8373001359bdd469698dd743b0c53c8094c2ce4692a4c446e877ec6dbe1e0a
MD5 9d1c472da4e619f3c07f904510ebbd0c
SHA1 bf73431d3303d80a3a48a548b1901cf093e11958
SHA512 a26fce6912ae2c5b692f2796a45e6e37472e09c5be017bcf3b35959fb62efe230a6496b1ebd400cef217d7f4fe3259f5481bf8103a9fcd87e320bd2adcfb0541
SSDEEP 6:7+/l9fKl4n1WQKRg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKDn:7+tRiqLiuWdwRmBEyPb4
TLSH
T16202228A63802822CA1D16BB90D583800D08E7199561CB27157008A87C834CCA8A0D84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.king7hub/databases/OneSignal.db-journal
Size 8KB
SHA256 97992a164ddc9f87d32d9a38e4f996beefbe73dbefa3812e20d5d8277d8bd9c8
MD5 483fb208ac21f568d05613a0824291c6
SHA1 a8add737581cfba0c0638e3490dc24e55aff34ff
SHA512 b2f9d2823693a514277085250d5ef003e5a106b34221006bdb9fc9d6c02ebf38568b7113f8dffa20dee1300becffd61962dc29356f860574b06dbe213020bfbc
SSDEEP 6:7+/l9EWHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKl0//MFn:7+t7vqLJdTRmBEyPblXMFn
TLSH
T1EE022289AB400813C11A17BB90E883442E20E7168223CB47156008B83D826CCA894E80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.king7hub/databases/OneSignal.db-journal
Size 512B
SHA256 b3d644c92899f5f73296666aeefd6fa609c6e41470d570b7e24501bddbfbee3d
MD5 46e05bd30b738b7e88252b902e9a59d7
SHA1 deeb43736ced10ebe002fba2fbbf650fbc7cd967
SHA512 95b65cdcb983c7fa25536387ef772a93589c57054a2f7ed5f567b52c8dffb3fbe1974804cc2fb2da190719fd851f935e0dd1344154f6de496238e8bb43aa4096
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events

Path /data/data/com.king7hub/databases/com.google.android.datatransport.events
Size 56KB
SHA256 ef5e15e6390a5c66ae3a45c4e72ea7f1d241e57c7fe64fc0258551f3c638f507
MD5 39e38efd2cf011c668f14cf3bf61c61b
SHA1 1d4c7d508279cb5c5078d9a6b5ec58e3bf34dee5
SHA512 0e4b61b7233826ccbeb9ee03d11bbba6a739f3cae3e2fc9ab7cc8c577aa9a41f219ea9e049387bb1929efbf0750fe657a2813dc414f2c26dcea8e17c578113f9
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSo:8MEX0wIyNjao
TLSH
T1BB43639D1E2C2221CA7E283ED3E143635B7C93DF5723927239948CFD8DC206974359A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.king7hub/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 c4b75a563254ec08d9786610a1509df39f99c40f546bc226a0580afa073f3ddb
MD5 684aa82f65d8dd0a87f940558d52eb84
SHA1 06df2586489fff7eeba4bbff283c8e3b5b821bf2
SHA512 e16dffe53cac862af5b4663b1110cbe601534a721b498afb2470ef63b7a9c74d8d7b273f5d3d048bc33849ac448c7b8f9a0f3097ae5a760f7f64bf79eb7a5b26
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.king7hub/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 cbb3490e6ba9eafbb17cbc517da7ca4aced8ac728d15239dfdd4a3ca3e267069
MD5 5161943b93a8eb6e5bc1c590b023f71b
SHA1 7edd7460a1fa948978cc8b3bd7665d4c45d7b151
SHA512 79057b79c45d835cd69e66fa586712ba31233af8916b505e715f81af23e21a40d5b60ac77ff7166376297cbe32a2ddf55ff75ea790c5888caaf870b237ff9b49
SSDEEP 6:7+/l9kFn1xg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK+:7+tSNqLiuWdwRmBEyPb9
TLSH
T11602229BA3812822C9391AB790E883950F01E7298561CF27256008983C034CCE4A0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.king7hub/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 ece70e9968aa2af11f1efc306cf9e42f3aa33064cbb644d34b6159d7f2c4cee2
MD5 8149516f76b5cc2414f3ab92747be7c0
SHA1 1f3bcb80d57d584197d62841d4bc8866f4c2aa31
SHA512 d5f4d13ebe23a115558cf61d538bba35f3660f1b871346de5f5e9195f649e29a9f8b4dbc39a343173844415013afd44d76af921a900b80c780e94de4695c6f15
SSDEEP 6:7+/l9SPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKbL//b:7+t4qLJdTRmBEyPb27b
TLSH
T1830222AAA3410813C01917B7A0C883422E10A714C22BCB27596008A83C03ACCA890E50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation2295142392435052817tmp

Path /data/data/com.king7hub/files/PersistedInstallation2295142392435052817tmp
Size 569B
SHA256 eb1d44fc04271ceaf422a9cd840979db569fb71c2717243b456492c23aa3f520
MD5 1bbd71beef398982ace7cc4aecce6eeb
SHA1 ca5d3bbba628d1da523c64261435008e5bed0981
SHA512 778fb60f288b6c0bd9826518167f80b446c5cc529db0c9fc962bc770c0d0c24bcc29c5c7f1fea1e5e2d55d8d4e7fd96263f696d9ba56845a775b42ff7a239ad7
TLSH
T151F026054E904715D4BE510769DDFC82AC0C5D7D55180AE9FDD1BC2748BCDBD729B910
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation7523673261304380435tmp

Path /data/data/com.king7hub/files/PersistedInstallation7523673261304380435tmp
Size 90B
SHA256 79542312c51a3ca021b09a17fc99882996f4075581c28313ca4cfc7887400e12
MD5 f9b09376e46bd290f3fcc7f31ee0ef27
SHA1 d51582d283f0fa01a7169785114656315f9bb940
SHA512 b9008b33446e3009213081e547299e799f9af21563132572cca0829a24203fe5d3526688ca06cf30d554956cc72a3b09da5973e0da01cdbaa087ad251d6b121e
TLSH
T1BBB012404B3146C18C95A2022C4CA2002F851A44084D8F444A19A44040C52E59343E98
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.king7hub/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.king7hub/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 819d2893f598d3763fb9e2e27d972826eb88491844dbc1d5f1347ef285d8452a
MD5 e09ba7ba3362bddf220f67ccc2d2a353
SHA1 0c50501b3ce4ba649fc6f1091036b578fc64c93c
SHA512 445b1cfd9038f3c44dcf24c23e409f6b5b56a624d13eded58722b213d060004ba413e6613b8b5de84e729b2d56c94f431e243ed8ee590fe7767e047012a6134b
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.king7hub/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.king7hub/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 792b4e674ddec091ca4cf5e1c56db2179f0aafc8b4809777d3a424ab7e56da17
MD5 05912aebada3c40a7b932d553ad6febf
SHA1 219f490c99e48aa515ba3d75f46ae4b5abd2699f
SHA512 b3cb7136f139e9503546702b3714f78d2ac5e024dafdb0aabfcea2d2ea3afc1858190bf344248a155259da82eae93d091ff65adf66d7635461de8c13d8a7c404
SSDEEP 6:KgDuSODFqlV9FZdrlOERX4PBX4ogLugMBX4suuK+/SD7WRF8jWucVOw2:KbODzdTRmBEyPbP/uWRircVOw2
TLSH
T11472C298BF8089A3C655227258F8C3451F6156A86312CB1B7651182D6D32B8C6450F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.king7hub/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 74d18117c82323b671fbf53855651458fa6f5947a8aeef3ce0bb22ae74444b57
MD5 3d13fe27356b7fd2786b07248062deb8
SHA1 08ffffde544490b711c86f5473b5f1cedeb436b2
SHA512 1dc5b0af382f9bfd5f736dbfda4b4bcf5095ed94f73b0fa70adb8ddb4eca58732acada6f13bae6b3e34c98c84bebd91c13a4d714a9a485f7e87a46a3578cc890
SSDEEP 96:JcDW7DP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:JcDundjnHt9S/f8JzSV+6D86T0ED
TLSH
T1DAB3348D1F596500C09974B099E00FF17A3E412EA393E3E135910079ADF2E24DE29EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.king7hub/no_backup/androidx.work.workdb-wal
Size 201KB
SHA256 d78ac2155dc383361daedd04b4456478a6a8319481e797d6c1f22dbd4e11d70a
MD5 e798875723ee114e6353be9ed2c33a8f
SHA1 7a6dbf0753f2205395fa9275cf9af853fbaf28ec
SHA512 eda85aca921b7aa8faffba36a6afdbc459854e0780f99168f587f2c9f7b2f794e20745fb1c63633cee6c2baf51900e9b03ebcc4142275c4765ac9e9f57920a19
SSDEEP 96:nuE21DtYRdUEjEdUuFukE21DtY2E21DtYlPE21DtY:ne1DtY/eh1DtYW1DtYx1DtY
TLSH
T19F1459EA3E1B8620EF0B1537AC2204F50B7714ED2BC35951B05B935C55BA70AD763B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads