General
- Target 派钱包.apk
- Size 5.0MB
- Sample251223-ry3eeasrf1
- SHA256 08c5044e32926a19f1ea6a176aa068a387cdf135c1af842ed25289f2ad63a85c
- MD5 d6ebdc765dfd399d64596bd579281684
- SHA1 50be931568c7825346dd11fb83e2731cb25a5457
- SHA512 2b6a7d5cfad75cec5df98f141ccba4321d0fc5fe8a89f206ee50f46dd24010104e42a99491c02cd16a28ebf9762f4d1b9899ea7ed53a1713585b9208bcf6a3e2
- SSDEEP 98304:4/mTv6H2v4G/zDH+O0tIXU89s7+XUvd+TdmqNUNvSJoTYrEmjaE1FBpIKloj:4ev6HY4G/zDwSXh9sDvTspLa
- MD5 SHA1 SHA512 SSDEEP
Behavioral task
behavioral1
Sample
派钱包.apk
Resource
android-x86-arm-20250917-en
Behavioral task
behavioral2
Sample
派钱包.apk
Resource
android-x64-20250917-en
Behavioral task
behavioral3
Sample
派钱包.apk
Resource
android-x64-arm64-20250917-en
Malware Config
Extracted
-
datzbro
-
154.12.50.119:4888
-
http://cdd.xmm.baby/
Targets
-
- Target 派钱包.apk
- Size 5.0MB
- SHA256 08c5044e32926a19f1ea6a176aa068a387cdf135c1af842ed25289f2ad63a85c
- MD5 d6ebdc765dfd399d64596bd579281684
- SHA1 50be931568c7825346dd11fb83e2731cb25a5457
- SHA512 2b6a7d5cfad75cec5df98f141ccba4321d0fc5fe8a89f206ee50f46dd24010104e42a99491c02cd16a28ebf9762f4d1b9899ea7ed53a1713585b9208bcf6a3e2
- SSDEEP 98304:4/mTv6H2v4G/zDH+O0tIXU89s7+XUvd+TdmqNUNvSJoTYrEmjaE1FBpIKloj:4ev6HY4G/zDwSXh9sDvTspLa
- MD5 SHA1 SHA512 SSDEEP
-
Datzbro
Datzbro is an Android banking trojan, first seen in September 2025.
-
Datzbro family
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network
-
Queries the mobile country code (MCC)
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
1