Extracted

• • Target
    jaffacakes118_bd2ff952f03f887d7796a5d8bb4597af802e8611e90c87f12cb3f09fd8f8b38c.bin
  • Size 5.0MB
  • SHA256 bd2ff952f03f887d7796a5d8bb4597af802e8611e90c87f12cb3f09fd8f8b38c
  • MD5 a69d065dabdf2da480a3f281eb6d9c2d
  • SHA1 d97b0e30a8f337a0b86d12f059b48c6403f1356d
  • SHA512 113aa2a23073839711d4724611a8df3ba22a395214b2cfe42648d4693ff7b18e370c4a9f235a21ecbc84a104913cf9fc18ebc21de321e9e88ed8d499df06c865
  • SSDEEP 98304:Xo/Ysq5Sw1+J6u48M90o8yZp0ndpsp67JoTYrE19aE1tmAXXgSL3:4/Ylt+M8M9789dKoFUmAg+3
  • TLSH
    T1CC36EFCAFBC8A96AC4F35336CA3542A651474C268783DFC35D54723C68BB6D04F5AAC8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutiondatzbroimpactinfostealerpersistencerattrojan

  • Family: Datzbro

    Datzbro is an Android banking trojan, first seen in September 2025.

    bankertrojaninfostealerratdatzbro

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery
  behavioral1behavioral2behavioral3