Analysis of a Polish BankBot

This report analyzes a BankBot variant targeting Polish Android users, distributed through malicious apps on Google Play (notably "Crypto Monitor", "StorySaver" and "Cryptocurrencies Market Prices"). It documents the trojan's capabilities—embedding phishing pages in WebView and harvesting credentials via hooked onJsPrompt, intercepting and exfiltrating SMS (including bank auth codes), using Firebase for messaging/tokens while sending stolen data to an external C2, lists targeted Polish banks and requested permissions, and provides IoCs and hashes for detection and mitigation.