datzbro | bd2ff952f03f887d7796a5d8bb4597af802e8611e90c87f12cb3f09fd8f8b38c

Analysis

max time kernel
124s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
10/09/2026, 11:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_bd2ff952f03f887d7796a5d8bb4597af802e8611e90c87f12cb3f09fd8f8b38c.apk
Size 5.0MB
Sample260910-nzyk3awvby
SHA256 bd2ff952f03f887d7796a5d8bb4597af802e8611e90c87f12cb3f09fd8f8b38c
MD5 a69d065dabdf2da480a3f281eb6d9c2d
SHA1 d97b0e30a8f337a0b86d12f059b48c6403f1356d
SHA512 113aa2a23073839711d4724611a8df3ba22a395214b2cfe42648d4693ff7b18e370c4a9f235a21ecbc84a104913cf9fc18ebc21de321e9e88ed8d499df06c865
SSDEEP 98304:Xo/Ysq5Sw1+J6u48M90o8yZp0ndpsp67JoTYrE19aE1tmAXXgSL3:4/Ylt+M8M9789dKoFUmAg+3
TLSH
T1CC36EFCAFBC8A96AC4F35336CA3542A651474C268783DFC35D54723C68BB6D04F5AAC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker collection credential_access defense_evasion discovery evasion execution datzbro impact infostealer persistence rat trojan

Malware Config

Signatures

Family: Datzbro
Datzbro is an Android banking trojan, first seen in September 2025.
banker trojan infostealer rat datzbro

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	zjhb.vfge.ctdxktxb
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	zjhb.vfge.ctdxktxb

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	zjhb.vfge.ctdxktxb

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	zjhb.vfge.ctdxktxb

Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	zjhb.vfge.ctdxktxb
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	zjhb.vfge.ctdxktxb
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	zjhb.vfge.ctdxktxb
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	zjhb.vfge.ctdxktxb
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	zjhb.vfge.ctdxktxb
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	zjhb.vfge.ctdxktxb

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	zjhb.vfge.ctdxktxb

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	zjhb.vfge.ctdxktxb

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	zjhb.vfge.ctdxktxb

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	zjhb.vfge.ctdxktxb

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	zjhb.vfge.ctdxktxb

zjhb.vfge.ctdxktxb
1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4763

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

accessibility_logs.db

Path /data/data/zjhb.vfge.ctdxktxb/databases/accessibility_logs.db
Size 60KB
SHA256 3d37c2c901d7bc8876fdb025e0141a50ec332f6aac9e3d49acd5a03c9089a4be
MD5 9e78339ebab8a0a0f17af02091363cf4
SHA1 e59da9803bfdb5039559e087276fcb3b5563941b
SHA512 b4ce7874bc6504fff1a5cde8c6b14fe33f00509423b3f06c2602347cf5ef79f722a86b4cc171bc8acab453c3f7b0474dc12187ff25afa24f5d22e697129741b5
SSDEEP 384:tOTD8fda+GnP6XGguFepab7pipzt+e2QIKIp4Yrrr0w:8TI4QxlYfP
TLSH
T18F5352C27B346573F5CF5434B23C17A2363096980E2017E37BA25DE65E07D880EA86EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accessibility_logs.db-journal

Path /data/data/zjhb.vfge.ctdxktxb/databases/accessibility_logs.db-journal
Size 512B
SHA256 92d6ddf878fc19b25e057da8b02dbe1d899eba260a396552e97982caa470f40b
MD5 82c555a84838b93c2d29732f4e4519db
SHA1 88be827eb75dee78fc27a847cad9c887bde0f41c
SHA512 8ef420129292c8428f1ea2662178611ec4ef927582df816c70d37154d9242cda8348b7ea2b21e9e71a3c5a9ad5651a52f92191a8656a6151085b7c9072cdc069
MD5 SHA1 SHA512

Submit Download

accessibility_logs.db-journal

Path /data/data/zjhb.vfge.ctdxktxb/databases/accessibility_logs.db-journal
Size 8KB
SHA256 b002e9f1fa213a55e135cd209b2a1835f01b29bb1a42b37ebd6e1c71d9be59be
MD5 759d6a3dfda4b8d1119b7ce6d655932f
SHA1 c2b2c0156fde1f319359c5bdb83682dc4da58324
SHA512 60c24f7bfea9772b1e77332931ca7536329a2b940e0cf15f494621eeaf8ce97811f65c5c00ab3658ec6ebe87c6e1bab47a1e3a16685378189136dcb23bbdd956
SSDEEP 6:7+/l9IZn1Xg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKgp:7+tcqLiuWdYRmBEyPbb
TLSH
T1C802C0CC6BC40913C82D177790D4836C0D08E7688171CB1F1E9048B43C878CDECA0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accessibility_logs.db-journal

Path /data/data/zjhb.vfge.ctdxktxb/databases/accessibility_logs.db-journal
Size 8KB
SHA256 59e2d0054c205c3124bf9cef621661036ee4e65bf91e2187a37f89c24d130101
MD5 af02f2f125a4a2d474fba4747b7ea37e
SHA1 6d7c82b9b31245f31b11f020f22a417b6bbb03a4
SHA512 b96f67ef4107b23926dec6e9735eed3fd3d97bdec91bee14404b003b3ca0a2858054345423a13b3697bfd76f73711ae49807f225e468fd19c8a2982988202b2a
SSDEEP 6:7+/l9LHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKLU/g:7+tdvqLJdeWRmBEyPbC0g
TLSH
T1CB0222886B400A03D1295777E0CD83901E11BB299323CB0756910C563C066CCA8D0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accessibility_logs.db-journal

Path /data/data/zjhb.vfge.ctdxktxb/databases/accessibility_logs.db-journal
Size 52KB
SHA256 de7c406980d402832308da6438b0aa8d7f5349ec2c1c4acb042cc37ad1bf5d86
MD5 1ca93d94e391c597a946c5c0e316f14d
SHA1 c79c1ce1ec1534a3270ddea93c819323a35ea396
SHA512 f4c338e4995e1acfd471251155b2ad877b552d67b43ac3bf6c4180da7439a5cd6f3f3cac24212fa7f32e4c3abafc161bec8fbd4ca175a0fcdbc9285c423c67ac
SSDEEP 48:7MiAqzB5zZz3mg0P4hHjb+Txvms9DvmwHxkvhSu:7XAgVOTPVMIu
TLSH
T1B2339F875768D113C3051236685037D07739AC26BAB499F729E427AA8FC72CA4933D3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accessibility_logs.db-journal

Path /data/data/zjhb.vfge.ctdxktxb/databases/accessibility_logs.db-journal
Size 52KB
SHA256 836ca73df2db51c074d259f4d508ffb139882eb2d067ce949be84128ade32d19
MD5 093527999098c1b5c902a68b7f25bf99
SHA1 3d4bffce3c5ac7361fe88243f0e7e9ea55de9d2c
SHA512 28b5a5b5a168eb334cdef975abbdd3ccca47eac0eb098a68b3b8a23fcef21411f0984a386e928b08fd65baae57fdda37f3ea5ba5b4c4e2b0487d44a8845688b9
SSDEEP 48:7MmUWslS23oTuJqDB5zZz3mg0P4hHjb+Txvms9DvmwHxkvhS7:7PEthJwVOTPVMI7
TLSH
T1B433AEC3172CE403C145523B981133E03725AC26E76C89E739E42BA84FC36DA5936E7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accessibility_logs.db-journal

Path /data/data/zjhb.vfge.ctdxktxb/databases/accessibility_logs.db-journal
Size 52KB
SHA256 4b9aecfb38537da6470b7909c7dc3db9476cc9411bf6631a664c3ae59e6edf95
MD5 8ff9e4544e52cce6e0a3ea161c629523
SHA1 d3add8be348251033791fe23e9697420e93e6b97
SHA512 398c5213d913f3df9e7ee6e01661117ec87b3786575a5ec93c6ebac7938c1671f4483ece11aa9db1bac477fd5594f745422d1f0ecf81f46977282e330dab9f02
SSDEEP 384:7lr0SZ64jjrvXGguFepab7pipzt+e18fda+GaqeOTW:5FdT9TW
TLSH
T1863331C33B34A473F5CF9434A63927E2363056980E241BE377A269E55E179840ED86EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service_heartbeat.dat

Path /data/data/zjhb.vfge.ctdxktxb/files/service_heartbeat.dat
Size 13B
SHA256 9fc580046b39988fedc019a8ffe3f0a0a7b63b8a91bea3f6c1e508f46953aeae
MD5 21d426e86c7916c6c884efb34ed7ba38
SHA1 7354ad2f62e11054554d5ad1a581325282b4d982
SHA512 20afa1aeb8c2959dad5faed482ec9bd0405693504ee965dc453f3cbecbb17184db79aa5f25f0154fd073cc5a03aeac95e6f5157bf69775ef462b5d9d14f188cb
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/zjhb.vfge.ctdxktxb/files/service_heartbeat.dat
Size 13B
SHA256 6b14448ee0d0880bbfd09ae2ffa16ea746af71aa18c182c4c754fad7f7c625fd
MD5 dc875e73c6d1b9bb5f24b35fce39d0c7
SHA1 77002ac80e6dc9bab35b8f56815ee28d47e50687
SHA512 80c997858df6fb4dcd7e6b9a368d03a256f56d61f8a31458d33ec0d45eb9bb8b24ae9e7b07d023536a4b3071ffd74a6419ee698a9642dc5ec2348636492b67ff
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/zjhb.vfge.ctdxktxb/files/service_heartbeat.dat
Size 13B
SHA256 e30626d52c6cc58b4ce31921bb5375b7a4c51b12b07d750a35496b93875bfc4c
MD5 39cce7b6823ffc397fc7bee89b8b6e1b
SHA1 66132b9200909627390d6715f7e1f5056f36e01e
SHA512 e73ae0756a9bf3f8628b14ebacf7290d2fb1519f3974ff8d03c75a4c1508e6eb383e2f03ef7680ca6d438f1dcf75f8a2cfb965c13f81895d6d2065c74f35eee9
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/zjhb.vfge.ctdxktxb/files/service_heartbeat.dat
Size 13B
SHA256 2e60422d0cec94bd6015ccc3a1ffb8411a679c0992ea59cd6e0a9dc32db57fc7
MD5 4040227d57e96b38cf637cca2a2c1c97
SHA1 5de1429c4cd1e26cdf8c875b9de0a6ecd1de3173
SHA512 3114af59f69a350c8518fe7479ba94c11ef38befd60107bed61e14cce94308f2f22ddefd1d5350e4d935619accd9b42c51d8ed66551c3b2d93427ebd0e422180
MD5 SHA1 SHA512

Submit Download

service_heartbeat.dat

Path /data/data/zjhb.vfge.ctdxktxb/files/service_heartbeat.dat
Size 13B
SHA256 0e16aaf7310bae8d83c2f15a27ac15503c928d8b7f0ff01ac51806eda3514cca
MD5 9c3f3b10e1d4ddc792c02d4338c6be23
SHA1 7640bf79cd9ac901cc76bf8b5b3ad53dee2f5599
SHA512 d4aca922b1fef30e6a2d3c4edc954022f5a0fbbda2c9e4524e1b2fa85bc02683da8478876e5dfe42bd4f3530e883fcb8b687a6e85ee7ff40d7270d8886b6bd0c
MD5 SHA1 SHA512

Submit Download

service_status.dat

Path /data/data/zjhb.vfge.ctdxktxb/files/service_status.dat
Size 1B
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/zjhb.vfge.ctdxktxb/no_backup/androidx.work.workdb
Size 100KB
SHA256 fd990d8d017101e95760a4a5aff48ac5cdf908987b2d7bf513f8e295b36e392e
MD5 9575af795ff2bd0ee225b695051d169f
SHA1 147a9e8ea6a52ff839f03540b1943342a581ccb3
SHA512 58647fdd198903fed967fff00607377d239393e57bba532267632d8cf8cf630808474bd956e2e7c3622d90af5c1d6ae63bbec85a9939b74e09289920690f8766
SSDEEP 384:ltYjtYr/IU7ndjnHt9S/f8JzSk6D86T0ED:ltYjtYBxHSsJzSk6D86ZD
TLSH
T1BDA375DE2F692244C469E4F0D8D40BE23C3D863DC792E3D579824165A9C3D32AA558FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/zjhb.vfge.ctdxktxb/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 cd06ebd058de0e9d55c9e9a2ac70aac1793de012a4ca20c08697e1dabc02f774
MD5 5106b1fda4883aae8792ec2b71d74bea
SHA1 3c82fbea5c99dd8edc45ac6bf7c895e4ab6705fd
SHA512 8489ba7b534f21536ec260207bd556176c5251b4f6b32ff4463683a9b385822b5014372ec64726e825c0af6b2f98a30f728425461bbe7a269636e21e1c1125f5
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/zjhb.vfge.ctdxktxb/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/zjhb.vfge.ctdxktxb/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 a3f10546e13a8c38a2c30b64f3ba61351da73533724dfd5e142ff0835ff1dc4b
MD5 55fccb759a5636cc3fb7b65a6dcf646a
SHA1 8e20814c8abbfe5cd9fc67d73b928e3ea4e3029e
SHA512 2ea058b0f6458a23eaa7ffee2b6dd0d79d166112310bd68ea49f1a2fa407eba2edce519a599ce142479d5b77046edccdce8fdb865b90ee73edfe4d542b4318f7
SSDEEP 6:K/a9pdpu9FZde/kPlOERX4PBX4ogLugMBX4suuK+/JWh5Hx1+Ow2:Ki9BozdeWRmBEyPbP/KHL+Ow2
TLSH
T14172C2AC93464AA2C31D92B2D8D4C7440EA0DA2C5353CB0B564125357C47BC8A091E0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/zjhb.vfge.ctdxktxb/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 131198bb946add60bce4197c8a626cbc80e4afe95183c9a39cecb9d95a3c9988
MD5 0bc7435e39fb2d1fb95e399a77f26ffa
SHA1 2c74b50eecc3cf2c40d8661a454358c1fd0ed06a
SHA512 8bf345f702a8dac11888ea2c93215f0af626fe0d0f2bc6338b8fbe3cde274c3c8ab49fb58545ff62996b5ccbe94b64de1be35fdc3d5cb78f0b25e18658024ac7
SSDEEP 96:+7Ew5DWXDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:+fDSndjnHt9S/f8JzSV+6D86T0ED
TLSH
T1AAB3FE8D0F1A6650C1ADA4F0E5A00FB1793EC12E9793E3E165910075BDC3E21DE2ACFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/zjhb.vfge.ctdxktxb/no_backup/androidx.work.workdb-wal
Size 406KB
SHA256 3054db2a6ab350445a2148e61534442d0e787e3d37211758552198192493f381
MD5 2f244b6cd9d5b801b077cef37da7a532
SHA1 db8b0cdcde560e8c2cbe603f98510d37c4605cc9
SHA512 e247f76abc24e1389b1110de8d3ccb275866564102add3e5fa0c592af753702282c0e9d48549744683948040fde710a5a9be566ec175ba3387817a5c9210c7c3
SSDEEP 1536:NY1YoYlYDYRYgYQYdYhYfYyYSY4YqY8Ym+YxYDYAYJYMY4YMYOYBYb:+H
TLSH
T1A894F0CBB893C2B9E79AE6F4CCB40BD33929D1F0948844899B07872D71D7F4721D6298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads