datzbro | 08c5044e32926a19f1ea6a176aa068a387cdf135c1af842ed25289f2ad63a85c

Resubmissions

23/03/2026, 18:52

260323-xjd16afv4k10

11/02/2026, 12:10

11/02/2026, 12:10

11/02/2026, 12:10

23/12/2025, 14:36

Analysis

max time kernel
150s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20250917-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20250917-enlocale:en-usos:android-11-x64system
submitted
23/12/2025, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
派钱包.apk
Size 5.0MB
Sample251223-ry3eeasrf1
SHA256 08c5044e32926a19f1ea6a176aa068a387cdf135c1af842ed25289f2ad63a85c
MD5 d6ebdc765dfd399d64596bd579281684
SHA1 50be931568c7825346dd11fb83e2731cb25a5457
SHA512 2b6a7d5cfad75cec5df98f141ccba4321d0fc5fe8a89f206ee50f46dd24010104e42a99491c02cd16a28ebf9762f4d1b9899ea7ed53a1713585b9208bcf6a3e2
SSDEEP 98304:4/mTv6H2v4G/zDH+O0tIXU89s7+XUvd+TdmqNUNvSJoTYrEmjaE1FBpIKloj:4ev6HY4G/zDwSXh9sDvTspLa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

banker collection credential_access defense_evasion discovery evasion execution datzbro impact infostealer persistence rat trojan

Malware Config

Signatures

Datzbro
Datzbro is an Android banking trojan, first seen in September 2025.
banker trojan infostealer rat datzbro
Datzbro family
datzbro

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	ewzp.fdbm.wjddeaubd
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	ewzp.fdbm.wjddeaubd

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	ewzp.fdbm.wjddeaubd

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	ewzp.fdbm.wjddeaubd

Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	ewzp.fdbm.wjddeaubd
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	ewzp.fdbm.wjddeaubd
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	ewzp.fdbm.wjddeaubd
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	ewzp.fdbm.wjddeaubd
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	ewzp.fdbm.wjddeaubd
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	ewzp.fdbm.wjddeaubd

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ewzp.fdbm.wjddeaubd

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	ewzp.fdbm.wjddeaubd

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ewzp.fdbm.wjddeaubd

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	ewzp.fdbm.wjddeaubd

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	ewzp.fdbm.wjddeaubd

ewzp.fdbm.wjddeaubd
1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4813

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

accessibility_logs.db

Path /data/data/ewzp.fdbm.wjddeaubd/databases/accessibility_logs.db
Size 60KB
SHA256 276e53cac20e2d9bc8eba7a3c3e73e31fb18925aca2eee178269e6c9059ca6de
MD5 b78699b4ac08e3e130a2c1ba4ccf01a5
SHA1 25a1da9c861a281a6251474410c0f1fbae29b494
SHA512 e078452de815457274d1d2dee899af51da1d64775cc8c1fcf18cc6181ceda8c5168b6393f82710dd0c6bd5ef5519ed2529d7635d0aadc8a38d132a461b29e414
SSDEEP 96:W2VOTPVMIplelMIbc/0hRhXl1SlGTCQQXvb2sQ9icx7VAzK/zPGyf13L9m1mFnns:fVOTld619iMKzKD81Uns
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility_logs.db-journal

Path /data/data/ewzp.fdbm.wjddeaubd/databases/accessibility_logs.db-journal
Size 512B
SHA256 f0f602f2c1925349786be0d193286f95c5700282bfb4e4e63cd93ba0466e0c12
MD5 93a049db2d12ec10f70429d0ba3a7b47
SHA1 1b57a635df08cfafdc886152964ba8ec23081bcf
SHA512 b754fc82bb5434111ac4fa3de709834ff9076099df85d722fde076d8c319ac75668b2e750b7bff9d61276d675616f918f6ce623eac1c1c6998d24e3bd85f5b9a
MD5 SHA1 SHA512

Submit Download

accessibility_logs.db-journal

Path /data/data/ewzp.fdbm.wjddeaubd/databases/accessibility_logs.db-journal
Size 8KB
SHA256 90e8212f7107a641368903b5771c4da64973e76866deda7be7c4157607db997e
MD5 b942bd301b53a93cc095537712edfe2b
SHA1 3f4a5577e81f2d6fcb4a5f861e10dbb4df5c63eb
SHA512 b549ec783edf267557e500c012f644c8f3875706f1d3a443bd17aa0c89605adc494c97923ef703e86ea60a5a7c8f92f83d919d996a5f9b7c7c1aad01e4e9d1cc
SSDEEP 6:7+/l9xlqFn1pRg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKo9n:7+ts/qLiuWdYRmBEyPbv
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility_logs.db-journal

Path /data/data/ewzp.fdbm.wjddeaubd/databases/accessibility_logs.db-journal
Size 8KB
SHA256 8f1066bda4613e539eb0d0ee24ebd5a6b3178faef14d0244c2cc4f4023b22c05
MD5 6511258466cf5f3c551f6884296b37ca
SHA1 983f8e85348e8ccc180b6d1a29cbdad110c81836
SHA512 cb1fe274103d6f99738ca6a27f8a5113d2fb457ba14cbb9a7bbd58f326ad0cef07a0881e17ed86a14045a805b392e92971f99ca021542bb5ca8c2c0a5908a1a4
SSDEEP 6:7+/l9VPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKPC/ZY:7+tbqLJdeWRmBEyPbwSZY
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility_logs.db-journal

Path /data/data/ewzp.fdbm.wjddeaubd/databases/accessibility_logs.db-journal
Size 52KB
SHA256 abde8b2bc28357ef76bf8fb88b92b314a04fcb98b699e40979d876db38971569
MD5 78a2dbd193537a5fbd5bcc9a29b986d5
SHA1 939fae6be71c4dc80f842ad4d24fd8af439e6e44
SHA512 1d49e35567790879430e05a2fb6122a93a648b262d6275fa83b9a250bc8609fd15c9522d644c84918775d2878ab18f80b8a658228c3606abe4db5cf138b04c5c
SSDEEP 48:7MtcYc9cCcnc0cpc+c0UcwcJc+cfqzB5zZz3mg0P4hHjb+Txvms9DvmwHxkvhSf2:7PbiVc3uR0XTORfgVOTPVMI+
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility_logs.db-journal

Path /data/data/ewzp.fdbm.wjddeaubd/databases/accessibility_logs.db-journal
Size 52KB
SHA256 f30f935903f6d0256ea912c0f974515bb0ccacd270c1eb8fd8ca6f25898beb49
MD5 34c6202eb9f8713f720a807e5947a94e
SHA1 cad29a4b8fdbd47593f98b095f4f235a6c176cc1
SHA512 5cc4a1ce90c3ccf320c629ece80364fda15458475f50aed2a91a8f7a8b95f76300c6fc19ebe42adf164182907f6d20d583c2d7b2b2715bdb770992ae15113f1c
SSDEEP 48:7MtsY4l2yqDB5zZz3mg0P4hHjb+Txvms9DvmwHxkvhSY:73Y4lHwVOTPVMIY
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility_logs.db-journal

Path /data/data/ewzp.fdbm.wjddeaubd/databases/accessibility_logs.db-journal
Size 52KB
SHA256 4ac6d0d2dd2b3ada261f8cf224b2cd5e9ce4ea64c2f21f8e06d581a44cb35191
MD5 aeb4359f426e39426cf9acf0bad3f06a
SHA1 5af6668e39aba933cc287903d337678b729c8493
SHA512 53a9fdaaf5b2df66260ff8798e5b8c74f1007c9f40e6c070b9121882bce46ae38d3bdafee453c9a821d64d66c9370e24b5bf45f91dadb9bdf53a394c8cd48cc6
SSDEEP 96:7bn1m1m7uf13LkNgjziQ9alelMIbc/0hRhXl1SlGTCQQXvbGbAVOTPVMI2:7zk11D/9sdibAVOTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

service_heartbeat.dat

Path /data/data/ewzp.fdbm.wjddeaubd/files/service_heartbeat.dat
Size 13B
SHA256 d33846167ab0db31c70b45642fd8d0299d219e0b3d6a824284e5c97b6143cccd
MD5 e6a34092e56354b510548aab9cb4d7cb
SHA1 713b36267d9a6f8eb555ec8724a0834a29a27d59
SHA512 11fc3da56f2d2ccb988ce71c2454814df360b8ab81bbec1577bc73829f1a9c9072c0116cd2eaeac95824664a633f99e0580234d9d683708cb085d5b6eb2a3a66
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/ewzp.fdbm.wjddeaubd/files/service_heartbeat.dat
Size 13B
SHA256 76a0fac9335b106e7376b64674d02437797a8d4c50ccd9a6163c22ccc725c3d5
MD5 c1aac38c75fb06aeebd2d26f3b308e63
SHA1 822db5dee4e7e9027e1d26d744b63aa8b152eb9e
SHA512 87bcf5e1ff3562fc95295bdf6e3c2986def22ec1759ab0d400544e102978eb93d1e8a2d5f76027331d17eab343b63111db42afedcd6a059c2a89dabdaff8b7e2
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/ewzp.fdbm.wjddeaubd/files/service_heartbeat.dat
Size 13B
SHA256 4c968bf014255d5f88090904f2345b9f86ac9e0dcc31ca8f6c12b214815f65f3
MD5 9946792c9ed5c89bb69733c05f4bb90f
SHA1 a0bd59bff7ee0132383f0b322116fab3d29fab3c
SHA512 16ae2b10b40e5500337d85027cb8a033a8ecc6776a239850ed478d6d72878b87471eec26be0f7cd677115dc97b363e511b7047c0ff86ea37c60043e8ef695614
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/ewzp.fdbm.wjddeaubd/files/service_heartbeat.dat
Size 13B
SHA256 27134b3b5ead5a4283900586e9b9f72c9e3baa45ce0be9f48016678e611ccace
MD5 562b6a0cd2de520feb5a06fa8a127ee3
SHA1 2668788359a3c71b5c6eb3627407db543464e859
SHA512 fe520959f94226fd152c867ba8d01b1a2dff309544d433241a705758a035bb8bfe09d8636f763f6450b5d66e9ee8a59faa7a489d87b0ad0881db3c6c4ef6b6dc
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/ewzp.fdbm.wjddeaubd/files/service_heartbeat.dat
Size 13B
SHA256 aaa82fa8dbd9dcf08a9d42f53d18e826464b210fc4f10b8c02a6c323e91827bf
MD5 4f70c2a1aae2a194cf2b8e48f1316db7
SHA1 22e192494febb9fa31f3656dbc0ebe6d62abbc2a
SHA512 1621d6b03738df62a60be80e0e8aa6243522359371fd1a9a67e9d92d495f4438cd8bb37717ce76f2916e44c6163be7c49934d5921e78a4a610c5c038cf99251f
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/ewzp.fdbm.wjddeaubd/files/service_heartbeat.dat
Size 13B
SHA256 fbca2ec2642a7153f4c871867d86620342df2db16882cf8757e91d5b017bed44
MD5 2b897a94d25e3a6be4e931dec651195a
SHA1 10951e0b44d6839b699c9ac67b0f694c417dccf8
SHA512 13ebc76983b3fc019b4ce9facc706c39469911512904e36894036fc71433a337fa8a7aa1e8ceb12aa887b018c25278399a8252d0a5eb9ff68066c699b64820d5
MD5 SHA1 SHA512

Submit Download

service_status.dat

Path /data/data/ewzp.fdbm.wjddeaubd/files/service_status.dat
Size 1B
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/ewzp.fdbm.wjddeaubd/no_backup/androidx.work.workdb
Size 100KB
SHA256 34ce9bcaafbd79941cfe40792e299e4c010e40569242d6882f9228fcde443dfc
MD5 cc60e880d3219df1abcee7ec9d003595
SHA1 efd9b5435d477231406086285e7c85447f826b15
SHA512 54bf7b30a3b05507a7244504271407727a005550436347cc14c5cdc55b6cc26d24ebb98dd1d9c963e7af824504495d6bcd6b05c3c70f6ba5f2b962b3162ecb9d
SSDEEP 192:1tYN6tYmfqindjnHt9S/f8JzSV+6D86T0ED:1tYN6tYy7ndjnHt9S/f8JzSk6D86T0ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-journal

Path /data/data/ewzp.fdbm.wjddeaubd/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 1dcb7547fd5a46917a9d594f089af906a6f2bffb545dd66fbc48bd45b3b5f1f5
MD5 5f24d4f74fd91e467cff82fc985946a5
SHA1 1772418d50738fe9361ca4d5e96dfa9d55cbedc4
SHA512 9aecebbbbeb8f59da3421ac0c4dfdbf9f3a40c93c5fe64fee5c2c47eb2f118a9e82d0bcd23180de4b7f650f9ccd475d8f3de8e81ee7bdd3660aab46a67c2e0a2
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/ewzp.fdbm.wjddeaubd/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/ewzp.fdbm.wjddeaubd/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 4486652c75403090d32a97c018cdf968a2b58ef656ce21af0eef11387b4d02c6
MD5 78b08d61bf9c17d87783a1bb434e4f84
SHA1 cbb849f1859241a01be81f8caf2df75222ab83ec
SHA512 19e0d856be2f67c481b446d7dc4418790d5f3f6ecb810b9223051895e2a23f257f4587b7172bea6e01c13cbdcf58744268183221aa7ae7473514afc091ea5657
SSDEEP 6:KOMYcoIYcny9FZde/kPlOERX4PBX4ogLugMBX4suuK+/7Ycq/Hx2MVhjjiOw2:KKc2c8zdeWRmBEyPbP/kcqPl+Ow2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/ewzp.fdbm.wjddeaubd/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 9b5259ea0f818e8471f9bae823a319aa282ce75473e0e5ca3137ef6dd383448d
MD5 687a724c37cb6241d6a16206f96917ef
SHA1 56eebb4941c203cfae6dba53b7b13e9b24d8e21f
SHA512 75d35f83a6260c25d934524c7a629a641eaab393808587ec703ac9555eec2f0d3ae73889500d193691acca0c1e8ed285c61715cbbcd8e2a9a0b98f5bfe75580f
SSDEEP 768:HrATSFKqiPGAuZxdcr78zw6GxHSsJzSk6D86ZD:HrATSFKqiPGAuZxdcr78zw6yzSk6Dx
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/ewzp.fdbm.wjddeaubd/no_backup/androidx.work.workdb-wal
Size 406KB
SHA256 eff94dd7995a2f9fa740ffadf738522853a0ee26fed719578f5f382a16a9c4ff
MD5 eccc5b09a0808efdc7e431ae91eb9987
SHA1 250c94f575290517568065085ab33b864e9c87b9
SHA512 9cb6fda08d0202af654b4cb22700d263662f2d69c18001ef45f35d81c420fedb56495f35d208e3e21a0eea2ff1d759b9733743cd6a4c5c1d21147c1e55411e53
SSDEEP 12288:3DTU0bWvoImWd8zez2YDVeVQMRgJLactz77ABxY4B1/DfQPuVY+V/r46+Hn:3DTU0bWvoImWd8zez2YDVeVQMRgJLac9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads