Overview

overview

10

Static

static

10

7d676cd16f...e4.apk

android-14-x64

10

Resubmissions

26/03/2026, 16:37

260326-t4vmvsdw3t10

26/03/2026, 16:36

260326-t4k4esdv9y10

23/08/2025, 22:03

250823-1ybfcsythx7

Sharing

Copy URL Twitter E-mail

General

  • Target
    7d676cd16f41a743973b97320c6dd35a9623cc2df3bb71a053107db1caed73e4.bin
  • Size 4.6MB
  • Sample260326-t4vmvsdw3t
  • SHA256 7d676cd16f41a743973b97320c6dd35a9623cc2df3bb71a053107db1caed73e4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
datzbroandroidbankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

  • datzbro

C2

  • https://m.iqiyi.com/

Targets

    • Target
      7d676cd16f41a743973b97320c6dd35a9623cc2df3bb71a053107db1caed73e4.bin
    • Size 4.6MB
    • SHA256 7d676cd16f41a743973b97320c6dd35a9623cc2df3bb71a053107db1caed73e4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutiondatzbroimpactinfostealerpersistencerattrojan

    • Datzbro

      Datzbro is an Android banking trojan, first seen in September 2025.

      bankertrojaninfostealerratdatzbro

    • Datzbro family

      datzbro

    • Datzbro payload

    • Checks Android system properties for emulator presence.

      defense_evasion

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Queries information about active data network

      discovery
    behavioral1

MITRE ATT&CK Mobile v16

Tasks