Loading malware…
FvncBot is an Android banking trojan targeting mobile banking users in Poland, particularly through impersonation of bank-branded security applications associated with mBank and SGB. The malware is notable for an apparently original codebase rather than reuse of leaked Android banking trojan source code. Campaigns have used multi-stage installation chains in which an initial lure application persuades the victim to install an additional component and enable a malicious Accessibility service disguised as a benign system feature, after which the device registers with attacker infrastructure and receives operator control instructions.
FvncBot centers on abuse of Android Accessibility Services for high-privilege surveillance and remote interaction. It can capture keystrokes and text changes from editable fields, inspect the active UI hierarchy, track user interactions, perform navigation actions, inject gestures, and display overlays. It also supports hidden VNC or HVNC-style remote control, allowing operators to interact with the device in real time from the victim side of banking sessions. Reported functionality includes screen capture and live screen streaming, including use of MediaProjection and H.264-based streaming, as well as WebSocket-based command-and-control for low-latency operator sessions.
The malware is designed to facilitate financial fraud directly from compromised devices. By operating within legitimate banking applications on the victim handset, it can bypass some conventional fraud checks that rely on device trust or session context. Reported capabilities include credential and sensitive data theft, collection of device telemetry and installed-app information, malicious overlays, and direct injection or execution of fraudulent banking transactions.
Observed samples indicate a staged architecture with dynamically loaded components and concealed payloads, including a final implant recovered from an embedded asset and executed after runtime decryption. This architecture supports defense evasion and complicates analysis. FvncBot has also been linked in reporting to the GoldenCrypt ecosystem and associated crypting services used to reduce detection during delivery.
Distribution has relied on social engineering and sideloaded Android applications rather than official app-store delivery. Victims are enticed with fake banking-security themes and prompts to install additional components under security or stability pretexts. The malware has been documented in campaigns against Polish users and is part of a broader wave of active Android financial malware.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“GoldenCrypt”, is reportedly affiliated ... with multiple malware families, including FvncBot, Albiriox, and Mirax.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
“Crypting” is what threat researchers generally refer to as a service or product wherein a file, almost exclusively a malicious executable of some kind, is encrypted to bypass malware detection technologies.
The app presents itself as Token U2F Mobilna Ochrona SGB, claims that a Play Component is required, and then guides the victim through the installation of a hidden second-stage application labeled Android V.28.11. After that, the victim is pushed into enabling an accessibility service presented as System Update.
The hidden asset is transformed with an RC4-like routine keyed by sDjCM and expands to the final implant dex.
The service builds a full JSON representation of the current screen, including text, content descriptions, view IDs, screen bounds, roles, and children.
The implant captures text changes from editable fields and records both the previous and updated values.
Observed backend traffic: https://jeliornic.it.com/api/v1/tracking/events https://jeliornic.it.com/api/v1/devices/register https://jeliornic.it.com/api/v1/devices/device_bf43438cc5236391/events/batch
The websocket client is built with OkHttp and adds X-API-Key when present: OkHttpClient.Builder timeout = new OkHttpClient.Builder().readTimeout(0L, TimeUnit.MILLISECONDS); | The HTTP helper uses both X-API-Key and X-Device-ID for authentication: httpURLConnection.setRequestProperty("X-API-Key", string); httpURLConnection.setRequestProperty("X-Device-ID", strG);
It writes the embedded APK directly from assets and launches installation: File file = new File ( opposeActivity . getCacheDir (), "installer_" + System . currentTimeMillis () + ".apk" ); InputStream inputStreamOpen = opposeActivity . getAssets (). open ( "apk/payload_grass.apk" );
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as a malware family reportedly affiliated with the GoldenCrypt crypting service provider.
Named as one of 17 Android malware families detected in the wild over four months.
A multi-stage Android remote-control implant chain disguised as Polish banking/security apps. It installs a hidden second-stage app, abuses Accessibility Services for remote control, keylogging, UI-tree capture, overlays/web-injects, screen streaming, command polling, and backend registration.
Android banking trojan (written from scratch) that abuses Accessibility for keylogging, performs web-injects, supports screen streaming and HVNC to enable financial fraud; masquerades as a security app.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.