datzbro | 76453c00b8a01e73529b2e7e08e3a948432838d1738975f7cf2a27155007c109

Resubmissions

23/07/2026, 15:43

260723-s6d78azxdy10

07/11/2025, 12:19

251107-pg7lpaymhl10

Analysis

max time kernel
113s
max time network
156s
platform
android-10_x64
resource
android-x64-20250917-en
resource tags

arch:x64arch:x86image:android-x64-20250917-enlocale:en-usos:android-10-x64system
submitted
07/11/2025, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tiktoktv.apk
Size 11.7MB
Sample251107-pg7lpaymhl
SHA256 76453c00b8a01e73529b2e7e08e3a948432838d1738975f7cf2a27155007c109
MD5 137fd3a0f9fdb8c9ae2150ead19bf2d4
SHA1 9c3a80bc93cbbf88a82a798fbf65d14d77b63c04
SHA512 eabe5a0a1b722bc93115851ca38964e947a8d4f5acefed4f5bd3e7818cef1250f1846426f8335863e054ad38a32f79a732202fdbe95e69dc57254ea77c4552a3
SSDEEP 196608:oxuJSiQVGdXA2+dvDmXf0LLNc53AS/mOI2+w5ebAKcXvfKeYQ:ozMO2+lD08iAEmHcebrcXvfTYQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

banker collection credential_access defense_evasion discovery evasion execution datzbro impact infostealer persistence rat trojan

Malware Config

Signatures

Datzbro
Datzbro is an Android banking trojan, first seen in September 2025.
banker trojan infostealer rat datzbro
Datzbro family
datzbro

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.yvtungwm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.yvtungwm

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.yvtungwm

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.yvtungwm

Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.yvtungwm
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.yvtungwm
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.yvtungwm
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.yvtungwm
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.yvtungwm
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.yvtungwm

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yvtungwm

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.yvtungwm

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.yvtungwm

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.yvtungwm

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yvtungwm

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.yvtungwm

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.yvtungwm

com.yvtungwm
1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5015

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

accessibility_logs.db

Path /data/data/com.yvtungwm/databases/accessibility_logs.db
Size 60KB
SHA256 b4e437f93da12f2de294edc9b12bd30c2373307fe08544b0eec97ba825191251
MD5 df53c8053793a92c7ecb6568e3f3ab02
SHA1 790eb1b110c128b1080548b2a701584ebebec7ee
SHA512 adde85725b386f3a9ada638454f0519a7ef3162a0d70ad40ac18499f31e31907f2a7aeccefb43f2ebc3beabca9e42fe2cdbf98c81cbc1bb9d4c460838f555d38
SSDEEP 96:nVOTPVMID3lylwN6BAbFBFSDEz7eSdFK/nyv:nVOT4wXeSfKQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility_logs.db-journal

Path /data/data/com.yvtungwm/databases/accessibility_logs.db-journal
Size 512B
SHA256 3348203711ee5eb5faf6d8d8532e2f06c39860853bbc4a0d9e61917bbfff4dfa
MD5 d9423ef4977e1b5098eec9256689c2e1
SHA1 babb7d63e78b0059c7b50ad89219c55b5ede6153
SHA512 ae4a717ca20d79e3ce518bd6bf0368367be6a1410cc156e2dffcf07243da7c2f50214bae9511b37083970aeba94b446c174528cd08adaf6d0dfd71cbab5fd9bd
MD5 SHA1 SHA512

Submit Download

accessibility_logs.db-journal

Path /data/data/com.yvtungwm/databases/accessibility_logs.db-journal
Size 8KB
SHA256 78a2c97ccf9777da5331ee28ced0487716c8b164474417343b2452ad33df54e2
MD5 f337e47262e28293ba69863b1a458bb0
SHA1 fa70205be27c8eb829eb08e31e4782ed6e7382ac
SHA512 9b94c96d86e9e04f09d77de99c4370e85e1d8435cd589647298961e1f036b0064a2182de48cdb12747ea34426c57d3864c2d39b0205fef57c2b6cb2792820316
SSDEEP 6:7+/l9LQn1JRg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKI/:7+t1KRqLiuWdwRmBEyPbn
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility_logs.db-journal

Path /data/data/com.yvtungwm/databases/accessibility_logs.db-journal
Size 8KB
SHA256 cb88a8060f524a6072236c27943f8144d0298693dfd0099c90f52d4c2b7b1432
MD5 cbee777a1d3323b4249be91e72e2463f
SHA1 8414754759a3d0e995565e324e2d866a3b5fc34c
SHA512 f7b35dcf5c1743d017693927c003bea5c2d418db08df56cdd7a3354562ee5dc88a236878a17790236b403c996fe58583761db83e0890cc084b5f2a77f36c4f66
SSDEEP 6:7+/l9+PxSFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK1kl//Yz:7+tEPgBqLJdTRmBEyPbBXe
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility_logs.db-journal

Path /data/data/com.yvtungwm/databases/accessibility_logs.db-journal
Size 52KB
SHA256 1d1f1c1cde3d657b898ef056fba71344bcb33932ade2c35da8a4acc3ace19fa6
MD5 ebbd13a8b15d16a74ec9f75034c65c3b
SHA1 43ca316013742ed6346d09f6c08bd2ea01dbec01
SHA512 9f056ceafea5eecf3e42bf9b952685ead844c2159543ece6e23891ab4f5f61c425d1ffb8da5780e83355daf918136ca7bf8cafe4eb87fe17ae57934a0776db99
SSDEEP 48:7MmhiDUd2Gvw4i4KzU5qLB5zZz3mg0P4hHjb+Txvms9DvmwHxkvhSn:77igIVOTPVMIn
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility_logs.db-journal

Path /data/data/com.yvtungwm/databases/accessibility_logs.db-journal
Size 52KB
SHA256 370699821906347d1d3b9704223ed79977e7af5a78b2a0cb670d255a15ce3a7f
MD5 34e0a251081584de59861bfd46d851c8
SHA1 8202d6a473334f06da0e9d281a5ddfbbf2ed130a
SHA512 728bdc487b9ec19a843c5d150b22bba1c4c358d692dd03bb56a1f30cede2fc72c857252b2606a709c0d7acf73f28e97d72b4b8d277ee0048a079d84ebbb58afd
SSDEEP 48:7MOxs8t0CDEz62jfOq6wB5zZz3mg0P4hHjb+Txvms9DvmwHxkvhSh:768ZDEz7OHYVOTPVMIh
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility_logs.db-journal

Path /data/data/com.yvtungwm/databases/accessibility_logs.db-journal
Size 52KB
SHA256 d39f702ab4c2f074d50e24b2a99cb6d6f70e9550a2d1c8cb5cf929abf6013d86
MD5 3ba58c6c4979d5999c4e2405d667e6b6
SHA1 85241e7ffcd8069c2951611208fa7911cbe56f6d
SHA512 e34732cf19ff6f6498e2bc60bf0fbe1c366b678afe8eb107f157a96d080cb2e4fd665a9c74ce100122fa84e6f64d43ee929d92612fb299625ffd1ca8318f0516
SSDEEP 96:79XYz+C7xCllwN6BAbFBFSDEz7SkdYVOTPVMIf:7kxEwXhdYVOTX
MD5 SHA1 SHA512 SSDEEP

Submit Download

profileInstalled

Path /data/data/com.yvtungwm/files/profileInstalled
Size 24B
SHA256 cc960b5142127dc5512d4dfbdf5790346a3657d1bb781b24fed7638187418a35
MD5 ec87181050a37796a08ec9f39013afd4
SHA1 955d362601c28c9e5516158a7207b11bd00e5f29
SHA512 94b4832523394192032f3d1c1e4eba61e9c7ca9d556681851bde0e19eb9122c231457be75a2ea8aeccd79ac22af1832b4b9c7c8669ecf9df44dfe77cbb8ee324
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/com.yvtungwm/files/service_heartbeat.dat
Size 13B
SHA256 023f4b02deccb600a4bb78b7ed1f014e4daf69617c4e4e792c366c8e8449d461
MD5 08aaed188e72bb1189cff92ddfc502d8
SHA1 c773d154e130be2668fb054be218edae36844564
SHA512 f0ff6894c5355951ca867a9cb6e366aa271e9cec423773d1492e883450d222b601bc9e1b3fc01eeb7ee7e8eead40edf94615f9cf04c9b968a2fe608d070bf339
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/com.yvtungwm/files/service_heartbeat.dat
Size 13B
SHA256 20cff1b87702c3e3dd432140a8d155010e3c706a7884aab2e879eb8094a822d5
MD5 b3c367dfecc49deea62c735dd227eb99
SHA1 c185b742c8134a946a78f127a1ce7ac744a91171
SHA512 d2a8f4401cdf7073b478330c251635370ff401e5b4258807f3577d45d6e6e23bdb62479f0352c8dee374fabc57d4f0310c1158577f85628e0aa375a2cd68b0fd
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/com.yvtungwm/files/service_heartbeat.dat
Size 13B
SHA256 80258de6165e5858194c24570c11a08d2fbe0354a57724202a6f78fd060d3955
MD5 d153dd99ab63566e9a3b8aa09fbf065c
SHA1 92cbd2dad7e4a3da3f70505fce3b6f6e94ba1bf8
SHA512 7984c4fff16a4f9b7bfd928de6add65a6e46ef898db83f85afffb75bfb26a17ec075f65d865a3a2716a87ffc3620a90e061d6b4d99402b7ae7f917ad9bf277df
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/com.yvtungwm/files/service_heartbeat.dat
Size 13B
SHA256 137acc93e56b1b40040dc2f2825c823ef0a1a5841e97f49b58874077f73cbf18
MD5 04511471c642806b81fef0d6d1850e38
SHA1 2c64321d03f35645431435eb3e31143357aeb72d
SHA512 d526d5bc352f61852dbf0861289a199ad92772ac8b9f2eda3860167b04e14f8de13b9e98ffe7dba95c4720ec1645bb960a3bf6ceacf61b6b0d63df1513245486
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/com.yvtungwm/files/service_heartbeat.dat
Size 13B
SHA256 442131d77919f37a9902c6b9fa5320f6231a5077b8318f1491a34144fc135259
MD5 3175b5b52026015c7e31404104840e94
SHA1 df0b49a4a096883a43025572110740004a9ef87a
SHA512 5b8d3a2ef986e1d2e71f7ba2678a13d468e4f1ef8664863ed4afdc1877d1a745f22c5a21aad3e75c0ad08de167897fbd7a7dce937e55a74145790a3da5d367af
MD5 SHA1 SHA512

Submit Download

service_status.dat

Path /data/data/com.yvtungwm/files/service_status.dat
Size 1B
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.yvtungwm/no_backup/androidx.work.workdb
Size 100KB
SHA256 ff05e4193d5b00ab1cf02e02a7ab0dbd8d913af19f6281b1288285757801b646
MD5 639610e6732910cf7ca26ba194ce87bb
SHA1 267b011f13ec8cf35da357819984054a313f05f0
SHA512 408379788449198de60d970b15b01e74928a8880297334972be9b93d29b360bca3554668ee5f41952fb5746e0ac4cefe0b9e5db5ff0c4fe46e23dcf138f828a8
SSDEEP 192:nftYktYm9MindjnHt9S/f8JzSV+6D86T0ED:nftYktYindjnHt9S/f8JzSk6D86T0ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-journal

Path /data/data/com.yvtungwm/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 c6ded64733885b4e73aaaccd6cc103c1f070d83089f0fdaea3443d60437aeae3
MD5 adb89372830e17c7556b2a1e628c589d
SHA1 4f096bfd9dbe523ddf941280f088ba4c28451440
SHA512 c57899207e0f01068f8a675586db0912df27dd2b1a715533b4be4e1a74bb6b73c98c825f0d5389af03f83de27cc00e7fc7a015fa1f489b17358abb13ec6aa8a0
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.yvtungwm/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.yvtungwm/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 d7b0915deefa616468bb284f4454fed071c4ca18501358dd95b9fb5b51817cd4
MD5 476d3287a7c98d2b0f078c76a5862946
SHA1 60f9d7161034732f61fb4a4a0c593ff36bf25797
SHA512 fa88779b22ad2e3390728b6a6b67ae272f9e4bce6aad82e2db1db78843b32ddf0242df433e313db2ddf83f8570ed81a21a052bd8cb51e4218c2715eda6871015
SSDEEP 6:K2qYDmYeO5g9FZdrlOERX4PBX4ogLugMBX4suuK+/dYhO/88ywE8yzU+Ow2:K/pJOEzdTRmBEyPbP/diOlRlWOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.yvtungwm/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 37e078abcc6202affddc7433a4e906160455998f8c5b1810ebb6dca567da54ab
MD5 00618c87c46b808cab5418b44f9ed55c
SHA1 8587db307bb07c71463c775286f442e9ea26c034
SHA512 d5759b4070f734cc3a2887a7834ef5aea20baea1cecaad86f2db0dcac36a457287830860a65805307e97b3d85d72bfe22321718321fecbe06f4d7f251292daf3
SSDEEP 96:sK9cPdS88smWcDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:s0cPdVcFndjnHt9S/f8JzSV+6D86T0ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.yvtungwm/no_backup/androidx.work.workdb-wal
Size 402KB
SHA256 62a06214d074302c8b10f9f61b7563a4dc471df716b7605d74c9a29831fd172e
MD5 846ef18bc57f0e7da7a389688a870eb0
SHA1 d6c69fb943d59e40036f888c0d43f0cbad59f58d
SHA512 362a6fe9718c4bc91ce8327a5d7e5355772804271d75995803625adcdf51c3da5b8dbf0743ee29228a4f163f3b34fc0d22a4e86c6b2287c9e180e87c57e62cce
SSDEEP 1536:mYBYVYNYUYWY8YuYsYuYOOYTYwY6YUY/YzYRYYYCYQY4YAYMYSYMY+:a
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads