181a75348ef246208b390b15139dd6acd2304d285ce7c6621e93cf77192dfc09

Analysis

max time kernel
149s
max time network
154s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
20/07/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
king7hub.apk
Size 10.8MB
Sample260720-w2a7jsbv8j
SHA256 181a75348ef246208b390b15139dd6acd2304d285ce7c6621e93cf77192dfc09
MD5 acd47a725e6d7f28202198f484168943
SHA1 82e615b20f64b5c22989c0c6ab03f080adfab6e1
SHA512 a7cfdabee41cf9dd7baf00f4da6abcb1329ae44c9346d0e390a40b9db8541cc6b544773a2c56c228c1dc44f1374fcb43e14364f4b67ffc25626f093bcfd04958
SSDEEP 196608:kJ7Ch9/Jk12BQah12BQaJyxQ7EhAJZBHkGgvEhvu7gk2jIrj365xxL5xPGYXu:kJyhBrOBrJn4yTNm50+SxLfP8
TLSH
T184B62381FBD8EC1FCC73803247A21676864A4C9AD782E38B5914B26C58B7AD44FD5FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/bin/failsafe/su	com.king7hub
/system/xbin/su	com.king7hub
/data/local/xbin/su	com.king7hub
/system/sd/xbin/su	com.king7hub
/data/local/su	com.king7hub
/sbin/su	com.king7hub
/system/bin/su	com.king7hub
/data/local/bin/su	com.king7hub

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.king7hub

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.king7hub

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.king7hub

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.king7hub

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.king7hub

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.king7hub

com.king7hub
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4820

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

OneSignal.db

Path /data/data/com.king7hub/databases/OneSignal.db
Size 52KB
SHA256 491c9687657ca71661a5cf42a763249f88fa222edaef20eaf552c4599458f99e
MD5 f1427539ecc4cedfa892efc1776ba3ed
SHA1 814607670e99768ae6212224860b0a1fb93733db
SHA512 c3ebbf63c4e876e471848f810e7ad7c0cb56a946230073b5196f7b3ce5d1f144c800ec5787992ff2ee057f712d7c7f1b92b47761294aede13183c796e5ab043d
SSDEEP 24:TLLS57ZBUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvJqrEqjUix5+xGTrOPjwVw:TE7AcrA0oJxqrKcrObMoOS
TLSH
T194338BCF4B862191EFC765B3155252E44E3B610E889317A63BF760245E83B16D72387C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.king7hub/databases/OneSignal.db-journal
Size 8KB
SHA256 7c388590b2e8be96bfb9b3f74ec4a0e56d41d4bbc544f9004224032797689d92
MD5 0bbb7f25a7cc85f91d1bff927e2afbb3
SHA1 f2d9ddaf2491fdad9f93dc947258ddb66c98a560
SHA512 0de5bfdbe0ea04ebc240194c734326fa28c09a3d57ecc8e4773216ec7198d7bc6035e3e8c3e28af5e13164cc224108ba3da04d99fe896853afd8c2d28e4d3bf0
SSDEEP 6:7+/l9vpPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKO/OIK:7+tLqLJdeWRmBEyPbVnK
TLSH
T1140222C863410803C26A277BA0C883A01E22A728A323CB2B9BA118582D8B6CCA890D10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.king7hub/databases/OneSignal.db-journal
Size 512B
SHA256 218165666ab42d56b928af1061edad7081b229d5cff79b02a7becd9ac3fb0c6f
MD5 154f2e99c90c5f50f8dd4a4052ec461f
SHA1 9fa6331b457341cab616b100d4e7f0a360ce452d
SHA512 4430e076f7ed26f7f4926ad644c7d2b433b1c06c3a8f7ef0e4db334de77ffe70227e31c6eafb17c45c8c43e0dc21ec5c46b62e19f0c2298d7fe79c3f85a49a25
MD5 SHA1 SHA512

Submit Download

OneSignal.db-journal

Path /data/data/com.king7hub/databases/OneSignal.db-journal
Size 8KB
SHA256 ccdd8ad663ac8be424f1c88a249b3da11bdb9ff3a0d413343ab5efc0e5a4c003
MD5 67d743475c3083a28a47c8820b4e6e3f
SHA1 f64635e4eaada735f6a8c63ba737920b54d7d9df
SHA512 9f7bb7e5a64ac2c8f92e5064335fd2ddbe6d497532bd9eab925c8799b66e6fb030d151aad2b2ec9b74767c762110aec307a763dd018ffb72efd4ce30e2b479a1
SSDEEP 6:7+/l9pn1CRg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKz:7+tkRqLiuWdYRmBEyPb8
TLSH
T13D02228A63800812C829167790F683400D00A7288161CB271A9008987C27ACCA8A0E44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.king7hub/databases/com.google.android.datatransport.events
Size 56KB
SHA256 fe0c63edb9483b976c3dc35d302ea8997b91bf78e287d6730252bce7ff63b7aa
MD5 3ab3e11aec5e0639bdfe1956ddf81fda
SHA1 5bd361e56e424f97e647d8cd3c420cd55306df38
SHA512 624bee18a707b4b68731bfe83f77a5686825d79fb304bf32083b9316fb24a565bea128e446996d8d07e86dec5c73a3f3391f469d0d71d411a86d9d526ee2e2cc
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSI:rAMEX0wIyNjaI
TLSH
T1A043639D1E2C2221C57E283ED3E143635B7C93DF572392623D948DF98DC246974354A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.king7hub/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 2830cf490e0bcbf96dd1d5266376ed60b080616b9d5306f4b4135e70f7cb3605
MD5 87e7aeb0c127b2e4aeff28e0f5f3ce2b
SHA1 7c01572e9d2e589a55e90e4b987742a4e685bb78
SHA512 a7450039101b4c14462f46df6f7cdaf4cbd5bc0217d385ff223e4c0c7a93a7195db912a674ecf2b3673448b22a20a20ff891dad94bcb99f62080e448662aed65
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.king7hub/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 3e5cfe237eacdda69dfdc410c16dc39c8e08e359f766b8da7f25eb107cc63018
MD5 006a0148e3ed53bdbd71fe8c9cd66668
SHA1 6866914967fd28b73a81ef45afc392da20f82a03
SHA512 afa5dc1cfbb3115d88287bb08956320ada28da2d32b675600d18eba8e831530908c5285685df5505ea5096ce1a9e5b08c54f3a6752cfa8e662183655cfb20bae
SSDEEP 6:7+/l9NuYn1Mg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK+I:7+tmhqLiuWdYRmBEyPby
TLSH
T16602C0AC73840813CC2D977B90D483400D8CE73881B3CB17179008943C8B4CCE4A0F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.king7hub/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 cda466d2e8a390546ec886d3bd7fe2e118ecb0aab57c4e0f1743dd266c48398f
MD5 b43b20ad07db65654d5415aa19a02412
SHA1 61c4f5817ec47eadd1a73a3608d76961c61ff1ad
SHA512 7c67a341f329bef45e90ed085c364066d4273b66cee982a44df6f7fb57d54f057a1a3fa8cd7a7f471db4d217a2228ac7dccae197cfa663b3d2b4dee4e33de280
SSDEEP 6:7+/l9PUHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK6ha/sIn:7+t2vqLJdeWRmBEyPbLYsI
TLSH
T15202228A63410803C0295777B0CC83401E18AF389223CB271A9208583C8BACCA890D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation1674959168842414328tmp

Path /data/data/com.king7hub/files/PersistedInstallation1674959168842414328tmp
Size 570B
SHA256 1d10c963299741c17ce9361db4bef9e14ad15836cde8a414cf36049c9eb89f17
MD5 a2cb11b11bd09dc43d3bfc6263aaeaad
SHA1 01c942ab56a0a7bb56695b8feea6eda7c6e3d526
SHA512 a75bdf9c6e2f979221b075ae76e0c42cfcd3ff8c71d2dd113c2dd9f1288919080d785688c50bc4640139aae6cdc50140b95decaa2e8dfbef1c945e966a5d0c73
TLSH
T160F0E10A4971461BC48F428A108F7C811C094494555946F5AF46D8E736A5BAEB103A08
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation1976301669898552791tmp

Path /data/data/com.king7hub/files/PersistedInstallation1976301669898552791tmp
Size 90B
SHA256 041ae88068465e969e6827b3f524481cf51c20b7975d0b7a7becff1f1873664b
MD5 f948db24f0cbe0c480cfc4764e709529
SHA1 a71fdac7d176fbf017cbd058a607de95aebfbff0
SHA512 2e12176e155ad2a8d54adb67120e605fc75e002618f2f8bee14053e1c415232fc54ee0341c4acec8798d9469c9fc0cc832ff66e6801c32221ef705164a63a0ed
TLSH
T1D5B012054A709256898DE3061C8D91402D9518801C8D8F594F08D24000A17D88103B9C
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.king7hub/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.king7hub/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 29eca58200156f5f3a8a469eff9f1587d17190d5bc52fda1b993c38c0e5b2c1d
MD5 300baf7bdce3ed8a925f766df569e219
SHA1 134889b763cfaabc10159aba8f15d90f3a16db8f
SHA512 169832bbda486dff1a886044835d20f0dc0b4be8113c96d47ef3fc67d8f7ce03de1dd80921ae6afb2f422b3d3151dedfd33cda0b830d0de76a85d3ccb326c9eb
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.king7hub/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.king7hub/no_backup/androidx.work.workdb-wal
Size 193KB
SHA256 55bac73cf41e53f3f5d3fccbd05afe357e8fbd3ea2992468b4d911757031a191
MD5 e376cf5fc88aaa23f0f41c308fde3c61
SHA1 7488acff88e84ceba4f543e65f67048e0ea55578
SHA512 52e7c2d1c02b460c2d327d3426125aba0e562bb186db6770c72b29b84e288e3a08c383b852e9d8e55acfde12206981e1653e334a27fc7486bb6f68cfdbf6a6ac
SSDEEP 96:h+pE21DtYq+QUET+gET+l0+5UuT+xuT+Q+++pE21DtYCy+ss+X+pE21DtYkb+7EG:01DtYIxq1DtYC71DtYd1DtYM
TLSH
T15B1438DE732E8878FE0B063BEE5291F101F786FC1A86511065FA87196ACB10EC35B906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.king7hub/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 5df1f2ccd7e44fab052487c975b1f986c1dd26746dc5f49fbc575f7cb2596377
MD5 243db47f2a3a8ac1cc474fddedb1f633
SHA1 cd0d6db37c5fd9402a063eb00b4677fe686f8fe9
SHA512 e7a4e65bdfa05f804d2f7d9ed4873b341901303f5bc699f4d5fa5271b6e6fd4b18ef97e33a36714c54da730a4cdfad4925b3cadad3ae133f5b5004e20e1a9b50
SSDEEP 6:KpWeOLa9FZde/kPlOERX4PBX4ogLugMBX4suuK+/T+X9GeAHOw2:KpZOLEzdeWRmBEyPbP/SX9sHOw2
TLSH
T17472C244E74415B3E1464B736DDAA3400D34963D6312CB0B517208507EC23CCE651E08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.king7hub/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 e4b6bbc644dd1ce40249fe0e73a0c6c5313b420a2576d44a4e1908e2173f195b
MD5 5bd06221ef35909a715cc9fd79e6db10
SHA1 dd3c1d04a991c00b0c296c560bd87ea8b39c3fbf
SHA512 b8511988166f227135bb0ec9788e79881d3ecb781ef43865b11646675d4809f5e8e83d85d7eb82239e2bef4075a073d78c1d001bd0b2827e9104791d5e326c10
SSDEEP 96:DjbtW6DP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:B3ndjnHt9S/f8JzSV+6D86T0ED
TLSH
T1A1B3028D0F592520C0A968B1AED01FA1793E813E9393E3E165B10075EED2921DF29CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads