Extracted

• • Target
    1a61fb2ced479772321d12fe492df0600f6b6030f52ca427bf5680c00e29b2b2.bin
  • Size 4.3MB
  • SHA256 1a61fb2ced479772321d12fe492df0600f6b6030f52ca427bf5680c00e29b2b2
  • MD5 29ff5e0e401a59fa8fb583c7c879cdb2
  • SHA1 4abcab7785b352ffc6845b1fde3eb101f59a5258
  • SHA512 6a7c7cf43042b742fc1ec65a69f126d18ff26e9d764f469fc905e33975967e3119243d34ff3af3cadc3e6f25e19b9af5ef7d73bb0d5f4d6663f34d5cc955eb1e
  • SSDEEP 98304:loTYrVx5Rf2PNWbipUy8EnWZbmP8dN9aoGEsL2B1brdEOKfTQao97:5RSVn7YH9b9aOYTQj97
  • TLSH
    T1EC26CECAFBC8A96AC4F35376C93592A655074C268783DEC36D54763C18BB6D00F4AEC8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutiondatzbroimpactinfostealerpersistencerattrojan

  • Datzbro

    Datzbro is an Android banking trojan, first seen in September 2025.

    bankertrojaninfostealerratdatzbro

  • Datzbro family

    datzbro

  • Datzbro payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries information about active data network

    discovery
  behavioral1