datzbro | 08c5044e32926a19f1ea6a176aa068a387cdf135c1af842ed25289f2ad63a85c

Resubmissions

23/03/2026, 18:52

260323-xjd16afv4k10

11/02/2026, 12:10

11/02/2026, 12:10

11/02/2026, 12:10

23/12/2025, 14:36

Analysis

max time kernel
149s
max time network
152s
platform
android-9_x86
resource
android-x86-arm-20250917-en
resource tags

arch:armarch:x86image:android-x86-arm-20250917-enlocale:en-usos:android-9-x86system
submitted
23/12/2025, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
派钱包.apk
Size 5.0MB
Sample251223-ry3eeasrf1
SHA256 08c5044e32926a19f1ea6a176aa068a387cdf135c1af842ed25289f2ad63a85c
MD5 d6ebdc765dfd399d64596bd579281684
SHA1 50be931568c7825346dd11fb83e2731cb25a5457
SHA512 2b6a7d5cfad75cec5df98f141ccba4321d0fc5fe8a89f206ee50f46dd24010104e42a99491c02cd16a28ebf9762f4d1b9899ea7ed53a1713585b9208bcf6a3e2
SSDEEP 98304:4/mTv6H2v4G/zDH+O0tIXU89s7+XUvd+TdmqNUNvSJoTYrEmjaE1FBpIKloj:4ev6HY4G/zDwSXh9sDvTspLa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

banker collection credential_access defense_evasion discovery evasion execution datzbro impact infostealer persistence rat trojan

Malware Config

Signatures

Datzbro
Datzbro is an Android banking trojan, first seen in September 2025.
banker trojan infostealer rat datzbro
Datzbro family
datzbro

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	ewzp.fdbm.wjddeaubd
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	ewzp.fdbm.wjddeaubd

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	ewzp.fdbm.wjddeaubd

Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	ewzp.fdbm.wjddeaubd
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	ewzp.fdbm.wjddeaubd
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	ewzp.fdbm.wjddeaubd
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	ewzp.fdbm.wjddeaubd
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	ewzp.fdbm.wjddeaubd
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	ewzp.fdbm.wjddeaubd

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ewzp.fdbm.wjddeaubd

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	ewzp.fdbm.wjddeaubd

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	ewzp.fdbm.wjddeaubd

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	ewzp.fdbm.wjddeaubd

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ewzp.fdbm.wjddeaubd

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	ewzp.fdbm.wjddeaubd

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	ewzp.fdbm.wjddeaubd

ewzp.fdbm.wjddeaubd
1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4271

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

accessibility_logs.db

Path /data/data/ewzp.fdbm.wjddeaubd/databases/accessibility_logs.db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

accessibility_logs.db-journal

Path /data/data/ewzp.fdbm.wjddeaubd/databases/accessibility_logs.db-journal
Size 512B
SHA256 5d70325d37e35e8865432e3d89692715ce06265cd0bf0b39d805e45204261b02
MD5 7acf568b6bf88208fa061cbe49b656af
SHA1 73dcd029b445d78a2ac080e98f65e40d54097353
SHA512 f4f9665a1bbb691d1a183d8f4a0c60c68c5a65086d022fd1f8bfd90895459994a72e39fe79a46067caf7228b3d0f06d71af6adbf8cf808eceac9cb5b567e55c3
MD5 SHA1 SHA512

Submit Download

accessibility_logs.db-wal

Path /data/data/ewzp.fdbm.wjddeaubd/databases/accessibility_logs.db-wal
Size 313KB
SHA256 5fae160e2f114e9d1afe885ba6e347694e0f45bfe6633efbad6a0bb2af54fa3a
MD5 35223a6e8a768dff15c9362e8d326b38
SHA1 7e48229a5f0d70155835acb676c32dfd136d2205
SHA512 e3f084983ce407ad6b875ac4231fc2d9930e34c4eee0414de5e6fb85c13d6eb85d93d3100efcabd1a7a48fe82d2a7adee0c1ee66027d640af748b739a6435672
SSDEEP 96:s0P7rVOTPVMIPkLjYZk3VbrXpBlAoVNVb4R2WLO0NVb97bVmTj0NVb/w+6M8qo:f7rVOTnSYUX52Vexb
MD5 SHA1 SHA512 SSDEEP

Submit Download

profileInstalled

Path /data/data/ewzp.fdbm.wjddeaubd/files/profileInstalled
Size 24B
SHA256 c75b08ce7dc5a6ae925ec76bf4b3cbca542bf0a22897ee12f0a5cf30a2175b98
MD5 1a9cfe256ccf4fb771906099fa38c576
SHA1 c08d550e15aadb98e153172df1bf53ef3ba02323
SHA512 bb2ce01b024518f0de65ec10052124fcf3435ed06343d8b6fccfbcfbacb8c04072b2834c877d64dad244acbbca313103f0bc9fd42f2af55babeff0073a3cb04b
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/ewzp.fdbm.wjddeaubd/files/service_heartbeat.dat
Size 13B
SHA256 5b525e579e907e8e5e3788b4bf8c3111ab9a8d22eddcb28c6fbfd0b5aa6b53e8
MD5 78e04556f0c4c6f802387f9801cb9f28
SHA1 36aca6003ef0396d964c8cc1886869a23cb58e69
SHA512 1fb3518b7868dd55ef12798c17cd8efd763804ec4840f4193d761be6fc5718954e3548957dff950863ebf242a4d2b8a0e549828ef6e57742bd521505618a768e
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/ewzp.fdbm.wjddeaubd/files/service_heartbeat.dat
Size 13B
SHA256 fcc5119260631f43efe299162473600a09d047838a5d8480398022f899651fea
MD5 92467113108a182260ae7e4287d22f75
SHA1 b0d3f64de427e8e2dfc4484899bd8a24b69e17a6
SHA512 a2858fa828a0c0285ac897c8e3bff87228b8fea934fba21695e05b945525224af35e170af05da35dd6427f93093f86de579a126768fa3ae610f7c8c8a279a5ee
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/ewzp.fdbm.wjddeaubd/files/service_heartbeat.dat
Size 13B
SHA256 6636a5c07c7413c0a957c676fd7cb912d6a88c988f5d95fa3f3a318025df17c0
MD5 59fac12b05a2595625eac1f0c6d699a9
SHA1 b2e9560d41b520753d1e3e33d6d0b9a03fea7314
SHA512 274cfd8084732f32ebd4c2e071136f4858cae42dbbf8c6b63079c334adbe7afe700a4c2f73175f3de9e0a568ec082d83ae27efbd07e3aed2e0c3829006714704
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/ewzp.fdbm.wjddeaubd/files/service_heartbeat.dat
Size 13B
SHA256 99c5473d3191c32229e2db9d5ce02a991bf6209cbf0055db922a551b23250007
MD5 3b823520bcd4418e00e22e63c02ce074
SHA1 71c2dbae452b5060f7b4d9259376750d186003db
SHA512 4714e6083d3c75ad3c0ccde307213ba05668aefa268c60ac87f891ed9ea8c447f45516e877b1adbb21a999e0a2538bee0b8a60e4f0ed574d6d81b4feb8ad258e
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/ewzp.fdbm.wjddeaubd/files/service_heartbeat.dat
Size 13B
SHA256 d3cb79cda4e6e86202d807c204638f8d5109069d51af5097f1128f43a93fc175
MD5 c10142a3ef632d6800479b6c3770ac46
SHA1 515e82b63642a86b7ef3b8f83093aae39e800122
SHA512 1fd475b9a51c383cfa3cd020adbc4096851e60354adcae9d39f475a5b513d8ba9f407c0968f12e563e24cbec4f3ac64a2219b33964f13bc51a8cc264a75e2682
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/ewzp.fdbm.wjddeaubd/files/service_heartbeat.dat
Size 13B
SHA256 2f8666c18055d4776a9b043c30adae78d9dcd59425cc41a35fd5409c48056748
MD5 c063f275d2d808d6c9e02eea9503f41b
SHA1 3d3baa8974e1ef785e981c2982cf0a77f6b8c042
SHA512 ea6a302bc98decb235b998f8bafbb70a7a6fbbd4c4d3dde546fdda0fcd66a7af7df120342bb38fb429d0f5dbb8c304258df71a999a2d86823e7516ec0102c4b7
MD5 SHA1 SHA512

Submit Download

service_status.dat

Path /data/data/ewzp.fdbm.wjddeaubd/files/service_status.dat
Size 1B
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/ewzp.fdbm.wjddeaubd/no_backup/androidx.work.workdb
Size 100KB
SHA256 d64278d6c22d8c832c1b4bd3d4fc7870fbec25d675c5e88ef245049f3ae8c8bc
MD5 ad0047b7830ad0044780405ec60fc0c6
SHA1 2000ede4a86016016c230609bcd8e1d1e2f04c4e
SHA512 46f7433089a204a4e9115a531e7e80d42984cb3db68d94f8f7b0e3648f721abbec10cf1662b864e26629382d40cc868a2a6afab995179d4b9488971715070ef5
SSDEEP 192:nftYetY4uYnindjnHt9S/f8JzSV+6D86T0ED:nftYetYbnndjnHt9S/f8JzSk6D86T0ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-journal

Path /data/data/ewzp.fdbm.wjddeaubd/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 325e880f65c4e72791378fe8c2566266d3eb42bda200de77aea8d750e804d298
MD5 8168a256610b54ed7d27220feb265c5e
SHA1 8dadd71b21b010fb7583edba28349e2fdf175c91
SHA512 3b5681806c0bac2b2a698ed0ec469bd254411c67c91b908574db8fd08ac907a93b8f198b244339b817b9eb091779d1ce16c1fc7cc5d4899c4d8005dec56db9b4
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/ewzp.fdbm.wjddeaubd/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/ewzp.fdbm.wjddeaubd/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 c6442b3cfe301249402f453223efae916db3534deae9ac1b5dd873a6817693f0
MD5 e26a22c96a202a4db94592742b5b94bc
SHA1 9eb7a872ec0c9743d7259d268219bc80f91d16fa
SHA512 61e43d4cc8c3cda7a25f2cb524c8de0f555a747328ffb31517a4d0ca3faf2d949ac89e3d9194309561eddf2965e5932416b2ddc1e675eace5e483ca728bb0513
SSDEEP 12:K0x8FMxSXzdTRmBEyPbP/WxitI1vO/iOw2:K0xdxSXzyGSP/Wxitjw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/ewzp.fdbm.wjddeaubd/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 354918f91991c1cd8f27e93a6b03512bee970166533423397da039d1c6d96a1f
MD5 bc0321525bf7cad894ad3ed14f4eecf1
SHA1 32d1716b418aab578f6f94d652e7134d28634125
SHA512 c283f21ae471da8548ddb949ad7cce5bcea9c8da254926066b00d2235753eff9ea066924d49c168180fbfab32d8ccc314984bb1c1cd559af39b905ee791b179f
SSDEEP 96:ggo8nWNDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:g8IndjnHt9S/f8JzSV+6D86T0ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/ewzp.fdbm.wjddeaubd/no_backup/androidx.work.workdb-wal
Size 402KB
SHA256 8e70c81a510faf23d9053dc51d574d18aa8227ad6dcfce4a17285176a4cd74db
MD5 1c9fbf22d594d090343853cf5d6d302a
SHA1 52a16aebdb0b437e80d94cb6eaac2abd909b44f5
SHA512 ecb35e9ac0b30b4483df8ac1dbeb66e1f010c1300b1c92a83f15d8dad4c18ed014d8edc1d36b8bafb328d323e391d88b7605d2557911d5daf559b9341f153ec7
SSDEEP 1536:cYLYDYfYXYqYwYlYBYKYfY3YpYgYMYDYvYNYTPYkYNYOYvYKYtYKYG:O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads