Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Malware

FvncBot

FvncBot is an Android banking trojan targeting mobile banking users in Poland, including campaigns impersonating mBank and SGB-branded security applications. It is disguised as a legitimate banking-security app and uses bank-themed social engineering to convince victims to install additional components, including fake "Play" or visible second-stage apps such as "Android V.28.11," and to enable an accessibility service presented as "System Update." Reported distribution includes unofficial websites, possible SMS phishing, and third-party app stores.

The malware is described as written from scratch rather than derived from leaked Android banking trojan source code. Its infection chain can be multi-stage: CERT Polska documented an outer loader package (com.junk.knock) that dynamically loaded an installer from /data/user/0/com.junk.knock/app_tell/tWyWeG.txt, extracted a second-stage APK (payload_grass.apk), and handed execution to a second-stage package com.core.town via the deep link core://setup. That second stage contained a hidden asset qkcCg.jpg, which was transformed with an RC4-like routine using the key "sDjCM" to recover the final implant dex.

FvncBot heavily abuses Android Accessibility Services for persistence, surveillance, and remote control. Reported capabilities include keylogging; capture of text changes from editable fields; reading on-screen text; tracking user taps; building a full JSON representation of the active UI tree; gesture injection via dispatchGesture(); and global navigation actions. It also supports overlays, including URL, HTML, black-screen, and loading overlays, enabling web-inject-style fraud and credential theft. The malware can inspect screen layout even when screenshots are blocked by FLAG_SECURE.

The trojan also provides hidden VNC/HVNC-style remote access and screen streaming, including reported H.264 streaming support. It can request MediaProjection permission and start screen capture for live operator sessions. Researchers reported that it can operate inside genuine banking apps, stream the victim screen, and inject fraudulent transactions directly from the compromised device, helping bypass conventional security checks.

For command and control and exfiltration, FvncBot has been reported using WebSockets for real-time sessions and Firebase Cloud Messaging (FCM) to receive commands. CERT Polska observed backend polling and registration traffic to jeliornic.it.com, including /api/v1/devices/register, /api/v1/tracking/events, and batched device event endpoints. Another report associated FvncBot with naleymilva.it.com. Campaign infrastructure also included hosting on ruvofech.it[.]com. Observed telemetry included device registration, milestone tracking events such as app_first_launch, install_permission_granted, installation_success, and accessibility_enabled, and exfiltration of device information, installed apps, logged events, and stolen user data.

High-confidence identifiers and artifacts mentioned in reporting include package names com.junk.knock and com.core.town, the exported accessibility service com.core.town.service.RemoteAccessibilityService, the deep link core://setup, hidden asset qkcCg.jpg, RC4-like key "sDjCM," build identifier "call_pl," and attacker infrastructure at jeliornic.it.com, naleymilva.it.com, and ruvofech.it[.]com. CERT Polska assessed the SGB-themed sample as another branch of the broader FvncBot campaign.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique
T1566PhishingEvidence1

In this campaign, all samples use different banks as disguises. This is the key social-engineering pattern in this campaign: the visible bank-themed lure does not perform the final malicious activity itself.

Execution

1 technique
T1204User ExecutionEvidence1

The user is shown an installation prompt for Android V.28.11. After installation, the lure changes to an Activate button. Pressing it opens a Setup Required screen that instructs the user to enable an accessibility service.

Persistence

1 technique
T1556Modify Authentication ProcessEvidence1

The overlay path also injects custom JavaScript into WebView content to keep input fields visible while the keyboard is open, which is consistent with credential-capture overlays.

Stealth

5 techniques
T1027Obfuscated Files or InformationEvidence1

"Albiriox ... packing techniques, to evade static detection"; "protected by a crypting service known as apk0day"

T1036MasqueradingEvidence3

The app presents itself as Token U2F Mobilna Ochrona SGB, claims that a Play Component is required, and then guides the victim through the installation of a hidden second-stage application labeled Android V.28.11. After that, the victim is pushed into enabling an accessibility service presented as System Update.

T1140Deobfuscate/Decode Files or InformationEvidence1

The hidden asset is transformed with an RC4-like routine keyed by sDjCM and expands to the final implant dex.

T1497Virtualization/Sandbox EvasionEvidence1

The installer checks the second-stage provider to see whether accessibility is already enabled: Cursor cursorQuery = getContentResolver().query(Uri.parse("content://" + INSTANCE.getPROVIDER_AUTHORITY()), null, null, null, null);

T1620Reflective Code LoadingEvidence1

The outer package is com.junk.knock... dynamically loads an installer stage from /data/user/0/com.junk.knock/app_tell/tWyWeG.txt using DexClassLoader.

Defense Impairment

1 technique
T1556Modify Authentication ProcessEvidence1

The overlay path also injects custom JavaScript into WebView content to keep input fields visible while the keyboard is open, which is consistent with credential-capture overlays.

Credential Access

4 techniques
T1056Input CaptureEvidence1

“primarily by recording keystrokes and capturing screen content.”

T1056.001KeyloggingEvidence2

The implant captures text changes from editable fields and records both the previous and updated values.

T1056.002GUI Input CaptureEvidence1

The operator can instruct the implant to display URL, HTML, black-screen, or loading overlays.

T1556Modify Authentication ProcessEvidence1

The overlay path also injects custom JavaScript into WebView content to keep input fields visible while the keyboard is open, which is consistent with credential-capture overlays.

Discovery

1 technique
T1497Virtualization/Sandbox EvasionEvidence1

The installer checks the second-stage provider to see whether accessibility is already enabled: Cursor cursorQuery = getContentResolver().query(Uri.parse("content://" + INSTANCE.getPROVIDER_AUTHORITY()), null, null, null, null);

Lateral Movement

1 technique
T1021Remote ServicesEvidence1

“utilizes hidden virtual network computing… perform actions on the infected device remotely… stream the victim’s screen and manipulate the device remotely to commit fraud.”

Collection

5 techniques
T1005Data from Local SystemEvidence1

The service builds a full JSON representation of the current screen, including text, content descriptions, view IDs, screen bounds, roles, and children.

T1056Input CaptureEvidence1

“primarily by recording keystrokes and capturing screen content.”

T1056.001KeyloggingEvidence2

The implant captures text changes from editable fields and records both the previous and updated values.

T1056.002GUI Input CaptureEvidence1

The operator can instruct the implant to display URL, HTML, black-screen, or loading overlays.

T1113Screen CaptureEvidence2

The implant can request MediaProjection permission and start a foreground capture service: startActivityForResult(((MediaProjectionManager) getSystemService("media_projection")).createScreenCaptureIntent(), 2001);

Command and Control

4 techniques
T1071Application Layer ProtocolEvidence1

Observed backend traffic: https://jeliornic.it.com/api/v1/tracking/events https://jeliornic.it.com/api/v1/devices/register https://jeliornic.it.com/api/v1/devices/device_bf43438cc5236391/events/batch

T1071.001Web ProtocolsEvidence1

The websocket client is built with OkHttp and adds X-API-Key when present: OkHttpClient.Builder timeout = new OkHttpClient.Builder().readTimeout(0L, TimeUnit.MILLISECONDS); | The HTTP helper uses both X-API-Key and X-Device-ID for authentication: httpURLConnection.setRequestProperty("X-API-Key", string); httpURLConnection.setRequestProperty("X-Device-ID", strG);

T1105Ingress Tool TransferEvidence1

It writes the embedded APK directly from assets and launches installation: File file = new File ( opposeActivity . getCacheDir (), "installer_" + System . currentTimeMillis () + ".apk" ); InputStream inputStreamOpen = opposeActivity . getAssets (). open ( "apk/payload_grass.apk" );

T1219Remote Access ToolsEvidence1

This sample is best understood as a multi-stage remote-control implant chain rather than a simple fake banking app.

Exfiltration

1 technique
T1020Automated ExfiltrationEvidence1

“logs these details into a storage buffer and transmits them to a remote server.”

INDICATORS OF COMPROMISE

IOCs tracked for this family

12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other
4 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app4 months ago
hash.sha256●●●●●●●●●●●●View more in app4 months ago
hash.sha256●●●●●●●●●●●●View more in app4 months ago
ip.v4●●●●●●●●●●●●View more in app4 months ago
uri●●●●●●●●●●●●View more in app4 months ago
uri●●●●●●●●●●●●View more in app4 months ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching12

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.