VORANT. Threat Intelligence Sign in Get the full feed

FvncBot Android trojan impersonates Polish bank SGB

routine threat financial-services

CERT Polska uncovered an SGB-branded Android banking trojan (FvncBot) that uses a multi-stage loader chain and abused accessibility services for full device takeover.

CERT Polska analyzed a new sample of the FvncBot campaign, an ongoing operation targeting Polish banking customers with fake bank applications. The analyzed sample masquerades as an SGB "Token U2F Mobilna Ochrona" app and uses social engineering to convince victims to sideload a hidden second-stage component disguised as a system update ("Android V.28.11"), then to grant it accessibility permissions under the pretense of activating a "Play Component". Once granted, the app registers with an attacker-controlled backend and begins full remote-control operation.

Technically, the campaign uses a three-stage delivery chain: an outer lure APK dynamically loads an installer via DexClassLoader, which drops a visible second-stage APK (com.core.town) that itself unpacks a hidden, RC4-encrypted asset disguised as a JPEG to reveal the final implant dex. The final payload is a fully-featured accessibility-based RAT supporting keylogging, UI-tree exfiltration, screen capture/streaming via WebSocket, clickable overlays with WebView JavaScript injection for credential capture, gesture/touch injection, clipboard manipulation, and a binary C2 protocol supporting numerous operator commands (app upload, permission requests, polling/heartbeat control, notification spoofing). Devices register to a backend at jeliornic.it.com and are tracked with per-device API keys and IDs.

CERT Polska notes that this SGB-themed sample shares the same staging architecture, backend infrastructure, and implant design as previously analyzed FvncBot samples impersonating other Polish banks, confirming it as another branch of the same ongoing campaign rather than an isolated incident. No distribution vector (e.g., phishing site, SMS, or ad) has been confirmed as of the analysis date, though the campaign's design (fake caller/lure flow) is consistent with vishing-assisted installation.

Mentioned in this report

Malware FvncBot
Campaigns FvncBot campaign

Related reporting

Detection guidance

DexClassLoader Dynamic Code Loading from Non-Standard Source

ATT&CK T1407

Android app using DexClassLoader to load DEX from runtime-downloaded or obfuscated asset - typical multi-stage trojan unpacking pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: DexClassLoader Dynamic Code Loading from Non-Standard Source
description: Detects DexClassLoader instantiation loading DEX files from dynamically-sourced
  locations (assets, cache, or downloaded files) rather than APK's native lib directory
  - characteristic of multi-stage malware unpacking and code injection. Excludes legitimate
  app frameworks that load plugins from known package directories.
tags:
- attack.execution
- attack.t1407
logsource:
  category: process_creation
  product: android
detection:
  selection:
    CommandLine|contains:
    - /data/data/
    - /cache/
    - /tmp/
    - assets/
  filter_known_frameworks:
    CommandLine|contains:
    - com.android.systemui
    - com.android.launcher
  condition: selection and not filter_known_frameworks
falsepositives:
- Plugin-based apps loading legitimate DEX modules from cache directories
- Mobile development frameworks supporting dynamic feature delivery
level: high
id: 5dbbbb10-f6bd-52f2-a98b-ed697eedfd84
status: experimental
author: Vorant

App Requesting Accessibility Permission for Remote Control Capability

ATT&CK T1516

App requesting android.permission.BIND_ACCESSIBILITY_SERVICE combined with screen capture or input injection intents - RAT capability pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: App Requesting Accessibility Permission for Remote Control Capability
description: Detects apps requesting both BIND_ACCESSIBILITY_SERVICE permission and
  capabilities to perform UI automation (screen capture, gesture injection, or UI
  tree traversal). Accessibility service is frequently abused by RATs for full device
  control; combining it with input/output interception is indicative of remote-control
  malware rather than legitimate accessibility tools.
tags:
- attack.execution
- attack.t1516
- attack.t1513
- attack.t1417
logsource:
  category: file_event
  product: android
detection:
  selection:
    FileName|contains: AndroidManifest.xml
    FileContent|contains:
    - android.permission.BIND_ACCESSIBILITY_SERVICE
  selection_ui_interception:
    FileContent|contains:
    - android.permission.CAPTURE_VIDEO_OUTPUT
    - android.permission.ACCESS_SURFACE_FLINGER
    - android.permission.INJECT_EVENTS
    - android.permission.RECORD_AUDIO
    - android.permission.READ_FRAME_BUFFER
  filter_known_accessibility_apps:
    FileName|contains:
    - com.android.talkback
    - com.google.android.marvin.talkback
    - com.samsung.accessibility
  condition: selection and selection_ui_interception and not filter_known_accessibility_apps
falsepositives:
- Legitimate accessibility apps that also integrate screen readers or remote assistance
  features
- Enterprise device management tools requiring both accessibility and recording permissions
level: high
id: 4be7d732-69a3-5b79-9dbe-d9961cb833e6
status: experimental
author: Vorant

Encrypted Asset Disguised as Image File Unpacked at Runtime

ATT&CK T1444

App extracting and decrypting binary data from assets named with image extensions (.jpg, .png) - obfuscation technique for hiding final-stage payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Encrypted Asset Disguised as Image File Unpacked at Runtime
description: Detects apps opening files with image extensions (.jpg, .png, .gif) from
  the assets directory, then applying cryptographic operations (RC4, AES, or other
  symmetric decryption) on the content. This is a common obfuscation technique used
  to hide malware payloads as innocent image files and decrypt them in memory at runtime.
tags:
- attack.defense-evasion
- attack.t1444
logsource:
  category: file_event
  product: android
detection:
  selection_asset_image:
    FileName|contains:
    - assets/
    FileName|endswith:
    - .jpg
    - .png
    - .gif
    - .jpeg
  selection_crypto:
    CommandLine|contains:
    - RC4
    - AES
    - Cipher
    - decrypt
    - cipher.doFinal
  condition: selection_asset_image and selection_crypto
falsepositives:
- Apps legitimately using image encryption for privacy (encrypted photo galleries,
  secure messaging with image obfuscation)
- Frameworks applying compression or transformation filters to image assets
level: medium
id: ab8d96c7-0c92-5c02-8aa6-4f37ad2c40e6
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/03/fvncbot-analysis

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free