7ecb81c506ed71d090e5acd97bf8e8c2d51ad6e4ffad302c1a99ccda8ff19b43

Resubmissions

22/07/2026, 09:26

260722-leamdsyyby7

22/07/2026, 03:14

260722-drmtgsab387

Analysis

max time kernel
46s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
22/07/2026, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Keystone.apk
Size 5.8MB
Sample260722-drmtgsab38
SHA256 7ecb81c506ed71d090e5acd97bf8e8c2d51ad6e4ffad302c1a99ccda8ff19b43
MD5 42ad5f74ff18b430b10f980ecc0be6a9
SHA1 5aa309219a98d1b7995676b074d8e10e47ee5cf9
SHA512 0526ba02502cbeddecb68259ae2761f22651283706dadb69feb0e2b3a565c6dbc877c96bb8c1f3290506886661e10bf2a819fc31cd23a97bead20f80b5d44dc1
SSDEEP 98304:VVKC/uEF15f2aFTPyurTpOKO1kRdMF5pppzH4EfqgmzN2e26:VMCRF15OaxFk1icppsgjmh9
TLSH
T14156DEC1AEED782ACF664137CB6AF1FD4573DD9E8A86815AB030F519087358C1E30AB5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.middletondynamics.keystone

Checks the presence of a debugger
defense_evasion

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.middletondynamics.keystone

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.middletondynamics.keystone

com.middletondynamics.keystone
1⤵
- Obtains sensitive information copied to the device clipboard
- Checks CPU information
- Checks memory information
PID:4782

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads