Extracted

• • Target
    y9gkybe5.apk
  • Size 14.8MB
  • SHA256 4f8772de262d164210b729f18c633c6fb65902d760ab0a7e4af7c2bd1453869d
  • MD5 5b59fdd9c5906041c56dd0ec33364992
  • SHA1 71fd22164e4493c814f83cdfc4e8ba8740eafc38
  • SHA512 f3f1e6d9a40543a4b41aa4ba0e2b772636221dc55f128e1effa36633d1e26a1dd78da0b22198d5d4ed05a46a65f62937b1579b05d7a5444e51f6231793f11a21
  • SSDEEP 393216:bgGpWEvEzS6ul7qM6/Ut1PVd9kNXcPkGkvLAbajiQkgbBvpjSByD:cG7MmVFO/i9EXcPk9UOjiJg9vpjS2
  • TLSH
    T156F622CBF7C8A96BC4F36376C93512A655475C2687438EC36D04723C58BBAD01F9AAC8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutiondatzbroimpactinfostealerpersistencerattrojan

  • Datzbro

    Datzbro is an Android banking trojan, first seen in September 2025.

    bankertrojaninfostealerratdatzbro

  • Datzbro family

    datzbro

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery
  behavioral1behavioral2behavioral3