Extracted

• • Target
    9d34cc48602f927f2d23510f2f7cbd1d041945d342d3dcf0773a1b996ca589e9.zip
  • Size 16.0MB
  • SHA256 9d34cc48602f927f2d23510f2f7cbd1d041945d342d3dcf0773a1b996ca589e9
  • MD5 7bcefc98eb6346c0ef74f606fbb1b077
  • SHA1 168413f87aff3b0d46cfde65e9b59090c28315dd
  • SHA512 81d8d44dfe5aa52d6af54c267ae56a8b7deda506b9b83276b55ffbca261cadc46982f73ee2192b1459f6f3f0df96d440748940497312b7b7245ff1324aa7ad2f
  • SSDEEP 393216:++Gjj8f/SXEoRnXOJT95z9MC4ZAECyJxAVEJdzUCIIhqVAixQJc5K:++Am/GxhXYXz+C4ZpnJxpOAiOJmK
  • TLSH
    T1560723B7EB54A06EC0B6463781B55D2252573D154983EB823D4C722C0BBBADC8F5EF88
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionfvncbotinfostealertrojan

  • FvncBot

    FvncBot is an Android banking trojan first seen in December 2025.

    trojaninfostealerbankerfvncbot

  • FvncBot payload

  • Fvncbot family

    fvncbot

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Acquires the wake lock

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery
  behavioral1