fvncbot

General

Target
iko.apk
Size 9.8MB
Sample260219-qkynmag17c
SHA256 908b0539d13b8e77abb36bedd0b0c0a290835e97077bf98f6115f876ffd1541d
MD5 464df337f7403d7265077b501ddecbc1
SHA1 ee17a19cff4ee760b3a621201e279eeb339616b8
SHA512 66013953ba3085d64a2663f8378c9ba9ab0dee88e653c1215175e1aa490deccb1947c5b054c947c4e756b69eea27c819fa8ab8ecc4415c979d6f03112e3a018d
SSDEEP 196608:F64CENZkxvSOY9iQvgNAgtExim7rRYF9WYA9NzB2tNnCRl7Huti:FbBNZ+vSOnVxtU7FYFtAFKNnCRl7d
TLSH
T14EA62302AF5AD4D5C0B78D37D5A546720292AE8804C3E6871D5CF1DD4ABEAF0EA1EFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  iko.apk
- Size 9.8MB
- SHA256 908b0539d13b8e77abb36bedd0b0c0a290835e97077bf98f6115f876ffd1541d
- MD5 464df337f7403d7265077b501ddecbc1
- SHA1 ee17a19cff4ee760b3a621201e279eeb339616b8
- SHA512 66013953ba3085d64a2663f8378c9ba9ab0dee88e653c1215175e1aa490deccb1947c5b054c947c4e756b69eea27c819fa8ab8ecc4415c979d6f03112e3a018d
- SSDEEP 196608:F64CENZkxvSOY9iQvgNAgtExim7rRYF9WYA9NzB2tNnCRl7Huti:FbBNZ+vSOnVxtU7FYFtAFKNnCRl7d
- TLSH
  T14EA62302AF5AD4D5C0B78D37D5A546720292AE8804C3E6871D5CF1DD4ABEAF0EA1EFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
behavioral1 behavioral2 behavioral3
- Target
  payload_fox.apk
- Size 6.2MB
- SHA256 2349bd69d35e5518cb7c7e908ae5d2c6553cf1bd3bd9eb9e32e1369fd17e98eb
- MD5 3b527ebcbd33e507bd5432c6e16bde76
- SHA1 55fd94fdc0aac8285d1469574085fee662c9f4a9
- SHA512 a1fe5a382f02a5c9b838221c377fc52d8960e87f61ffd87f44844a0f88d3765b01c98a5af640d318d814daee43edb4a35717dc9babc11296f36255be1b30364c
- SSDEEP 98304:Uib0IVaG6oTwr1qQIr66nbHAkdxA2H3pp1DdQG0yRYR6tRB9rUsF/yb96:1bHVaGZDrbzAsAeppz5Lo6HB2sFKQ
- TLSH
  T16C560186BB84E4ABC0B745324175932241474D964D83EBC72D48B56C0DBBAE4AF2FFC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion fvncbot infostealer persistence trojan
- FvncBot
  FvncBot is an Android banking trojan first seen in December 2025.
  trojan infostealer banker fvncbot
- FvncBot payload
- Fvncbot family
  fvncbot
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
behavioral4 behavioral5 behavioral6