Extracted

• • Target
    ed2313bfebe03ff29a7c802ddd471583cc8da76bf5cb9f418ae7d999d6a0b9fb
  • Size 5.5MB
  • SHA256 ed2313bfebe03ff29a7c802ddd471583cc8da76bf5cb9f418ae7d999d6a0b9fb
  • MD5 1d6131755bc1a5ec334d4e2ad641888b
  • SHA1 9a632d442b462e80b6e28380ce7de2f441410ab8
  • SHA512 79985ddbf7c8c7cca0945453cd0c0a8e1ec2d3e8cd9ce98c23c808426970d1bcbf6cf40d9d22063420dee6fa151dc4e3e6370b1fd8b17647c9082e8e7e371872
  • SSDEEP 98304:ytYv5LVWXDRBlcv3/qdFr55jUJTrooAjtoIB//O7Ug/D7CNJzoO6C+oTYrVK:FvDWXFBlcHcVUJ4hoIBU7rOTz5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutiondatzbroimpactinfostealerpersistencerattrojan

  • Datzbro

    Datzbro is an Android banking trojan, first seen in September 2025.

    bankertrojaninfostealerratdatzbro

  • Datzbro family

    datzbro

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery
  behavioral1behavioral2behavioral3