Extracted

• • Target
    ys20251106.apk
  • Size 6.1MB
  • SHA256 b4a2b67743a781eaa7ab5f4a46043feb33be398cfb0d87050ce9ef8c14a7e91d
  • MD5 eb4eedc2480194e4ba629361f4757f63
  • SHA1 86f22a0781fb8fb692930db2dff8f95481abaf98
  • SHA512 267a179fc61b5f79fbbf6294b9c9ae9181f1a43ebc02980d933a9222bb630657b21fa315fc3058fc06033d58449b60a1b187365891e4ff7799a62ce44ad656df
  • SSDEEP 98304:mojQtuwPFvOoVKeHbcklcVCvmqE2D0nj9GL7x1k4tIH/nsXAW1bIQrJoTYrEne:JjQtuwgo4e4krvYRpk7zk4tc/njW1b1
  • TLSH
    T15056F1CBFBC8A96AC4F76336CA3552A585474C268783DEC35D14763C18BB6D00F4AAC9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutiondatzbroimpactinfostealerpersistencerattrojan

  • Family: Datzbro

    Datzbro is an Android banking trojan, first seen in September 2025.

    bankertrojaninfostealerratdatzbro

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery
  behavioral1