datzbro | 08c5044e32926a19f1ea6a176aa068a387cdf135c1af842ed25289f2ad63a85c

Resubmissions

23/03/2026, 18:52

260323-xjd16afv4k10

11/02/2026, 12:10

11/02/2026, 12:10

11/02/2026, 12:10

23/12/2025, 14:36

Analysis

max time kernel
41s
max time network
151s
platform
android-10_x64
resource
android-x64-20250917-en
resource tags

arch:x64arch:x86image:android-x64-20250917-enlocale:en-usos:android-10-x64system
submitted
23/12/2025, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
派钱包.apk
Size 5.0MB
Sample251223-ry3eeasrf1
SHA256 08c5044e32926a19f1ea6a176aa068a387cdf135c1af842ed25289f2ad63a85c
MD5 d6ebdc765dfd399d64596bd579281684
SHA1 50be931568c7825346dd11fb83e2731cb25a5457
SHA512 2b6a7d5cfad75cec5df98f141ccba4321d0fc5fe8a89f206ee50f46dd24010104e42a99491c02cd16a28ebf9762f4d1b9899ea7ed53a1713585b9208bcf6a3e2
SSDEEP 98304:4/mTv6H2v4G/zDH+O0tIXU89s7+XUvd+TdmqNUNvSJoTYrEmjaE1FBpIKloj:4ev6HY4G/zDwSXh9sDvTspLa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

banker collection credential_access defense_evasion discovery evasion execution datzbro impact infostealer persistence rat trojan

Malware Config

Signatures

Datzbro
Datzbro is an Android banking trojan, first seen in September 2025.
banker trojan infostealer rat datzbro
Datzbro family
datzbro

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	ewzp.fdbm.wjddeaubd
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	ewzp.fdbm.wjddeaubd

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	ewzp.fdbm.wjddeaubd

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	ewzp.fdbm.wjddeaubd

Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	ewzp.fdbm.wjddeaubd
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	ewzp.fdbm.wjddeaubd
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	ewzp.fdbm.wjddeaubd
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	ewzp.fdbm.wjddeaubd
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	ewzp.fdbm.wjddeaubd
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	ewzp.fdbm.wjddeaubd

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ewzp.fdbm.wjddeaubd

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	ewzp.fdbm.wjddeaubd

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	ewzp.fdbm.wjddeaubd

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	ewzp.fdbm.wjddeaubd

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ewzp.fdbm.wjddeaubd

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	ewzp.fdbm.wjddeaubd

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	ewzp.fdbm.wjddeaubd

ewzp.fdbm.wjddeaubd
1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5069

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

accessibility_logs.db

Path /data/data/ewzp.fdbm.wjddeaubd/databases/accessibility_logs.db
Size 60KB
SHA256 2a196891289fd97e7c703999246f743e5c392fd94e8fdf7b183af05f7c0dbd45
MD5 17983c8fc67483219b43c22b172795f8
SHA1 6e8cba8c3e32b27555bee0cc4a8cd6935e068680
SHA512 3cd770736388aa339ec17138cc42b2ca6e8c746f42ff847289e2542eca5fced6081c6be9eb10733d68aa06d35d6768b0b9d578e41626931329f75a254715cf56
SSDEEP 96:3VOTPVMIbDl/Plc/0hvHhclClmi4hhhbj7ss0FQM3gxK/DyaTJUbxkn+hL:3VOTzQfTB7r0+CgxK2aixdF
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility_logs.db-journal

Path /data/data/ewzp.fdbm.wjddeaubd/databases/accessibility_logs.db-journal
Size 512B
SHA256 dbd5dae8dd091a66213ffac8e8052efa9396ec7e337086343fb7dfb7be184d0b
MD5 37f5ed6ac94f8c673fc2f574242e8b03
SHA1 8cc277be14e3492efbfc0f1c3a3151ac4c4c08b2
SHA512 998cf03b5348ddb9548e79d5b6907aa808c4e2b33ca1ad90bc11643a91615b61991c509989fe4ce41565832cf4cba0b2e255f836cf4fa778b26e49314b7e5e17
MD5 SHA1 SHA512

Submit Download

accessibility_logs.db-journal

Path /data/data/ewzp.fdbm.wjddeaubd/databases/accessibility_logs.db-journal
Size 8KB
SHA256 46aaeabdb8f2ffe15cc3d00f2ebec72244c49300d16f961afcf7bdb9e26c85cc
MD5 4dbbe79378ecb7fd7631fc0d2a606c4c
SHA1 4fde2a5aad405bec8d657aeca69bd1c923002fe2
SHA512 f4865e86b07bd391b54732c9315fb1f2ad17e58364da41ec2cfa0775b5d0ff1dfb8a0752c84ade8c080357ae1c686aaee0319ba02025168c62e2920b0c112f7d
SSDEEP 6:7+/l9hCzGn1qpg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK64:7+tmpqLiuWdwRmBEyPbL4
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility_logs.db-journal

Path /data/data/ewzp.fdbm.wjddeaubd/databases/accessibility_logs.db-journal
Size 8KB
SHA256 1a2e53c777e56e2295b9ea8e261d89d9e727a10468d110d4c8cb6bb04d3d3d1c
MD5 2b5619e4c24529cf49c949a5627faefb
SHA1 c9f8cb3cf2c93a5482652585c84300e958fd98c3
SHA512 efec34d5da027716fd93fb92a8350acb11e4d766f4438c26c139c13a30cf554ae627522619e8fd06dafe51573f8d1ae032dda6e857c5f48462b2de36070ed950
SSDEEP 6:7+/l9XuQUHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKuK//3:7+t1uDqLJdTRmBEyPbs3
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility_logs.db-journal

Path /data/data/ewzp.fdbm.wjddeaubd/databases/accessibility_logs.db-journal
Size 52KB
SHA256 a8c72f4960577abe52ca829dee4bcef3cb4088a8fa7e08d797a01370a3bc3d08
MD5 461a22e304cf07c5837b6ad8e5ecfa28
SHA1 14932c89db93f8f3c07a40141db2853798365cb0
SHA512 20ff20ccb8d85878b80fde8e6c10a5b895c00b0e29b45da8f8bda025ca7ca877ebbe5bb9286358adfad7f89b68dd2da5b0ceb26f4ab3b336797ae52dd436e5e0
SSDEEP 48:7MYcqLB5zZz3mg0P4hHjb+Txvms9DvmwHxkvhSA:7FcIVOTPVMIA
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility_logs.db-journal

Path /data/data/ewzp.fdbm.wjddeaubd/databases/accessibility_logs.db-journal
Size 52KB
SHA256 0f70bd41c9ed7527497f59689d8459d70e6c5e84cc0281580080f076e8da966d
MD5 e59469b0728bfaa3fea8ab28f7327332
SHA1 fe54185e8163eb4d723053545f629bf5993a66d8
SHA512 492c6c08226b7ea88bfab1b7aa0b09cc62942f0f313b1442996c4f8249183fb51620d10280357426c40aa660c42a9f5dcdd31da1614f4b96eb7f56b67aea934c
SSDEEP 48:7MFsQ+nDDhb3q6wB5zZz3mg0P4hHjb+Txvms9DvmwHxkvhSa:7PQ+DDhb3HYVOTPVMIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility_logs.db-journal

Path /data/data/ewzp.fdbm.wjddeaubd/databases/accessibility_logs.db-journal
Size 52KB
SHA256 ebe15f31b66cd675e3234a97319cf4cb797259f672abde6170101ca32919f6cd
MD5 95db361870bc517f0d06d55c668908ed
SHA1 d2c4d0632eb649c05d0dd6e8eeca8438fe93d0ea
SHA512 4d68b300fc0cc07a999d3ccd39e6a6867a075c4c41242afed0dabce92fb18831a5905da73e775fbabb4c003abfffa4f7cff0706bfc6c45e3ab51492ba6dc91b8
SSDEEP 96:700iNc9Ubxo+PKQV0d/l/Plc/0hvHhclClmi4hhhbjJIVOTPVMIC:70ldxfZV0d0fTtJIVOTa
MD5 SHA1 SHA512 SSDEEP

Submit Download

profileInstalled

Path /data/data/ewzp.fdbm.wjddeaubd/files/profileInstalled
Size 24B
SHA256 0ce21089e633efe2c5df2defffb7ae9b01c29042c2f5d2c7aa1b002dde305d52
MD5 38502d1a3d78c852171a26cc421d0fce
SHA1 081ce01f2cd83ab79c1204f9a86fbd42ae3357ba
SHA512 e3f019f1de6fdfd935eae1a701179d4eafb2dcf426091cb6fd33b5c2ba6e13d6bd7b312adc03b876bec32388e0c1eccefe165cae86ba60ab024de626b445a955
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/ewzp.fdbm.wjddeaubd/files/service_heartbeat.dat
Size 13B
SHA256 0d64e4e2570440fdc7e821d58786516208e6112fbd21beb9b1801e5cecf9f45c
MD5 0b2a33fd057b168d93cc9b4d8728c2a1
SHA1 731e01987b320eac68313f3773a6f40de1c72e55
SHA512 b330d877690f59a04501ff90bb0fbf7d0beef03938daaf7eccb60fae9b236c8d7c0d9ca82e192b7473439e428d8577616a0f391f2553ef6a70505d11480b3bab
MD5 SHA1 SHA512

Submit Download

service_status.dat

Path /data/data/ewzp.fdbm.wjddeaubd/files/service_status.dat
Size 1B
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/ewzp.fdbm.wjddeaubd/no_backup/androidx.work.workdb
Size 100KB
SHA256 4f7c094802dbddc83b7e76890268558462e8ce1bc43b808c34aa31989ecc1e56
MD5 4f088e576faa6e16bff93a14d8f60763
SHA1 a11b64b7ceca10e54c075c6f7fb4cf39a5c620d4
SHA512 5e9a54f4f7020f7a7917cf9fcd8a96a3df185c8214bac0f5e7fb9e83abfceb3f6652100da9d16058c3361d0ffa973fab85281e458ad8d48794940c9b52ed7d67
SSDEEP 192:nytYx2tYuUwindjnHt9S/f8JzSV+6D86T0ED:nytYMtYpndjnHt9S/f8JzSk6D86T0ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-journal

Path /data/data/ewzp.fdbm.wjddeaubd/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 8ccc14d536c11eb340959d5c1cc2b75ada36c9b9f34c4d6e1b8b853c3a043286
MD5 d1d7063af2d310d134e92e0f337f1cb5
SHA1 3ebb6140fdc17d39d7b593fcc9eab0b424301920
SHA512 8ebdfce75b94557fe9a622550c27f0fb0ebaa35ec483b80e305b05ec5b0b1270140e9184136526ee729766c3609aa117fa49bb1e86aebcf206efdfaebcfe0dda
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/ewzp.fdbm.wjddeaubd/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/ewzp.fdbm.wjddeaubd/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 419cf4f6bdbc5142dbb32759bc27af0cbf61198c1efa9855eceffac4f6086403
MD5 0537219000dc24d1984317a96f4b4b45
SHA1 3e77a6e6188d4c5dbb682855b5ca2bcce76cb512
SHA512 b904064a8a93628d16112e523aae4bd109cd720e31cbf71885a0c957da623f0c8275922edf4b634fff4ea4e166e7702cd5d444f58dce8a7d2415100f9156469e
SSDEEP 6:KIMg+wEUTRg9FZdrlOERX4PBX4ogLugMBX4suuK+/8kt/tt1d1mjiOw2:KIMdwEUdqzdTRmBEyPbP/H/XtOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/ewzp.fdbm.wjddeaubd/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 021ee97cdcb01db2cee4dc61879f11ac5b4cf045a48be9a619c1225cb7d4f03b
MD5 7c1178c23673ae56b7b1a871661b5a4e
SHA1 04efd434051b612488dcc02cb3dcb15562a6c665
SHA512 10806bf2c40383a8c4f77f7c2e8bdfb86e99aa9757f5204cd5ad3fe898b6ef1673ca5118ddbf0929c7e6e5742c8b00ab242260a097a4b458ec91ca399ca41bda
SSDEEP 96:VAGtkZWJDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:VjkZkndjnHt9S/f8JzSV+6D86T0ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/ewzp.fdbm.wjddeaubd/no_backup/androidx.work.workdb-wal
Size 402KB
SHA256 58deb579c957bd274db75ff67962fe6ef3e7c788d64394210acc3cad10045093
MD5 a7dec9ed93bdb90e9eac2c9eed737a00
SHA1 c23a4d2b7543b38b15b84cca42f956fa7d1eb6b1
SHA512 6d58db231f105a2736a35eec897f9a76cef0b3b0c545fecaa523db10449c60d757cbf73ad3f5c1564fda7ed3ad31b76e4d9428ddcfffb4b99d37d83e04a304ea
SSDEEP 1536:ghY/Y9YUYuYaYLYzYMYVYnYzY9Y4YNYEYEYEYZ:m
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads