{ "id": "3f7b5e79-ab00-489b-a9df-42e5eb810dcb", "created_at": "2026-04-06T00:21:17.822185Z", "updated_at": "2026-04-10T13:11:34.390362Z", "deleted_at": null, "sha1_hash": "8e4db419d9a04988d29ecd81a1e67131c1484114", "title": "Deceive the Heavens to Cross the sea", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 129431, "plain_text": "Deceive the Heavens to Cross the sea\r\nPublished: 2024-10-01 · Archived: 2026-04-05 21:55:51 UTC\r\nThe “Deceive the Heavens to Cross the sea” stratagem comes from the first chapter of the ‘Thirty-Six Stratagems’, a famous\r\nChinese collection of tactics and techniques used in politics, war and civil life. It translates to “hide in plain sight” or “mask\r\nyour true goals”.\r\nAndroid banking trojan actors have taken this stratagem to heart and have been very adaptable over years to new Google\r\nPlay app store restrictions introduced to limit their operations. These restrictions include setting limitations on the use of\r\ncertain (dangerous) app permissions, which play a big role in distributing or automating malware tactics.\r\nIn this blog we will discuss the recent techniques used to spread Android banking trojans via Google Play (MITRE T1475)\r\nresulting in significant financial loss for targeted banks. We will also discuss the, sometimes forgotten, by-product of\r\ncollecting contacts and keystrokes by Banking trojans, resulting in severe data leakage.\r\nIn the span of only 4 months, 4 large Android families were spread via Google Play, resulting in 300.000+ infections via\r\nmultiple dropper apps.\r\nA noticeable trend in the new dropper campaigns is that actors are focusing on loaders with a reduced malicious footprint in\r\nGoogle Play, considerably increasing the difficulties in detecting them with automation and machine learning techniques.\r\nThe small malicious footprint is a result of the new Google Play restrictions (current and planned) to put limitations on the\r\nuse of privacy concerning app permissions. Permissions such as Accessibility Service, which in previous campaigns was one\r\nof the core tactics abused to automate the installation process of Android banking trojans via dropper apps in Google Play.\r\nBy limiting the use of these permissions, actors were forced to choose the more conventional way of installing apps, which\r\nis by asking the installation permission, with the side-effect of blending in more with legitimate apps. This is one of the core\r\nreasons of the significant success of mobile banking threat actors in sneaking into Google’s trusted app store.\r\nA second big factor behind their success is that actors have set restrictions, with mechanisms to ensure that the payload is\r\ninstalled only on the victim’s device and not on testing environments. To achieve this, criminals use a multitude of\r\ntechniques, which range from location checks to incremental malicious updates, passing by time-based de-obfuscation and\r\nserver-side emulation checks.\r\nThis incredible attention dedicated to evading unwanted attention renders automated malware detection less reliable. This\r\nconsideration is confirmed by the very low overall VirusTotal score of the 9 number of droppers we have investigated in this\r\nblogpost.\r\nHow we help our customers\r\nThreatFabric makes it easier than it has ever been to run a secure mobile payments business. With the most advanced threat\r\nintelligence for mobile banking, financial institutions can build a risk-based mobile security strategy and use this unique\r\nknowledge to detect fraud-by-malware on the mobile devices of customers in real-time.\r\nTogether with our customers and partners, we are building an easy-to-access information system to tackle the ever-growing\r\nthreat of mobile malware targeting the financial sector. We especially like to thank the Cyber Defence Alliance (CDA) for\r\ncollaborating and proactively sharing knowledge and information across the financial sector to fight cyber-threats.\r\nThreatFabric has partnerships with TIPs all over the world.\r\nIf you want to request a free trial of our MTI-feed, or want to test our own MTI portal for 30 days, feel free to contact us\r\nat: sales@threatfabric.com\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 1 of 28\n\nIf you want more information on how we detect mobile malware on mobile devices, you can directly contact us\r\nat: info@threatfabric.com\r\nAppendix: IOC\r\nBrunhilda Dropper Samples\r\nApp name Package name SHA-256\r\nTwo Factor\r\nAuthenticator\r\ncom.flowdivison a3bd136f14cc38d6647020b2632bc35f21fc643c0d3741caaf92f48df0fc6997\r\nProtection\r\nGuard\r\ncom.protectionguard.app d3dc4e22611ed20d700b6dd292ffddbc595c42453f18879f2ae4693a4d4d925a\r\nQR\r\nCreatorScanner\r\ncom.ready.qrscanner.mix ed537f8686824595cb3ae45f0e659437b3ae96c0a04203482d80a3e51dd915ab\r\nMaster\r\nScanner Live\r\ncom.multifuction.combine.qr 7aa60296b771bdf6f2b52ad62ffd2176dc66cb38b4e6d2b658496a6754650ad4\r\nBrunhilda Dropper C2 URL\r\nURL\r\nhxxps://protectionguardapp[.]club\r\nhxxps://readyqrscanner[.]club\r\nhxxps://flowdivison[.]club\r\nhxxps://multifuctionscanner[.]club\r\nAnatsa Dropper Samples\r\nApp name Package name SHA-256\r\nQR Scanner\r\n2021\r\ncom.qr.code.generate 2db34aa26b1ca5b3619a0cf26d166ae9e85a98babf1bc41f784389ccc6f54af\r\nQR Scanner com.qr.barqr.scangen d4e9a95719e4b4748dba1338fdc5e4c7622b029bbcd9aac8a1caec30b5508d\r\nPDF\r\nDocument\r\nScanner -\r\nScan to PDF\r\ncom.xaviermuches.docscannerpro2 2080061fe7f219fa0ed6e4c765a12a5bc2075d18482fa8cf27f7a090deca54c\r\nPDF\r\nDocument\r\nScanner\r\ncom.docscanverifier.mobile 974eb933d687a9dd3539b97821a6a777a8e5b4d65e1f32092d5ae30991d4b\r\nPDF\r\nDocument\r\nScanner Free\r\ncom.doscanner.mobile 16c3123574523a3f1fb24bbe6748e957afff21bef0e05cdb3b3e601a753b8f9\r\nCryptoTracker cryptolistapp.app.com.cryptotracker 1aafe8407e52dc4a27ea800577d0eae3d389cb61af54e0d69b89639115d527\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 2 of 28\n\nAnatsa Dropper C2 URL\r\nURL\r\nhxxp://195.201.70.88/api/update\r\nhxxp://178.63.27.179/api/update\r\nhxxp://91.242.229.85/api/update\r\nhxxp://195.201.70.89/api/update\r\nGymdrop Dropper Samples\r\nApp name Package name SHA-256\r\nGym and\r\nFitness Trainer\r\ncom.gym.trainer.jeux 30ee6f4ea71958c2b8d3c98a73408979f8179159acccc01b6fd53ccb20579b6b\r\nGym and\r\nFitness Trainer\r\ncom.gym.trainer.jeux b3c408eafe73cad0bb989135169a8314aae656357501683678eff9be9bcc618f\r\nGymdrop Dropper C2 URL\r\nURL\r\nhxxps://onlinefitnessanalysis[.]com/\r\nMalware Samples dropped\r\nMalware\r\nFamily\r\nApp name Package name SHA-256\r\nAlien.A\r\nMaster Scanner\r\nLive\r\nleaf.leave.exchang 74407e40e1c01e73087442bcdf3a0802121c4263ab67122674d9d09b3edf85\r\nAlien.A\r\nGym and\r\nFitness Trainer\r\ngesture.enlist.say e8cbcc34af3bd352767b7a9270dd684a50da2e68976a3712675526a7398550\r\nAnatsa.A\r\nPDF AI :\r\nTEXT\r\nRECOGNIZER\r\ncom.uykxx.noazg d42e0d3db3662e809af3198da67fdbd46d5c2a1052b5945401e4cdd06c1977\r\nHydra.C\r\nQR\r\nCreatorScanner\r\ncom.cinnamon.equal 9ab66c1b7db44abaa53850a3d6a9af36c8ad603dab6900caba592497f632349\r\nErmac.A\r\nQR\r\nCreatorScanner\r\ncom.tag.right fd7e7e23db5f645db9ed47a5d36e7cf57ca2dbdf46a37484eafa1e04f657bf02\r\nAppendix: Targeted apps\r\nAlien.A Targets\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 3 of 28\n\nPackage Name App Name\r\ncom.kubi.kucoin KuCoin: Bitcoin Exchange \u0026 Crypto Wallet\r\ncom.abanca.bm.pt ABANCA - Portugal\r\ncom.bitfinex.mobileapp Bitfinex\r\ncom.changelly.app Changelly: Buy Bitcoin BTC \u0026 Fast Crypto Exchange\r\nes.liberbank.cajasturapp Banca Digital Liberbank\r\nwit.android.bcpBankingApp.millennium Millenniumbcp\r\nes.openbank.mobile Openbank – banca móvil\r\npt.bctt.appbctt Banco CTT\r\ncom.exictos.mbanka.bic Banco BIC, SA\r\ncom.kraken.trade Pro: Advanced Bitcoin \u0026 Crypto Trading\r\ncom.plunien.poloniex Poloniex Crypto Exchange\r\ncom.kutxabank.android Kutxabank\r\ncom.bitpay.wallet BitPay – Secure Bitcoin Wallet\r\ncom.binance.dev Binance - Buy \u0026 Sell Bitcoin Securely\r\ncom.bbva.netcash BBVA Net Cash ES \u0026 PT\r\ncom.coinbase.android Coinbase – Buy \u0026 Sell Bitcoin. Crypto Wallet\r\ncom.rsi.Colonya Colonya Caixa Pollença\r\ncom.transferwise.android TransferWise Money Transfer\r\npt.bancobpi.mobile.fiabilizacao BPI APP\r\ncom.bancamarch.bancamovil Banca March\r\ncom.mycelium.wallet Mycelium Bitcoin Wallet\r\ncom.cajasur.android Cajasur\r\ncom.tecnocom.cajalaboral Banca Móvil Laboral Kutxa\r\nnet.bitbay.bitcoin Bitcoin \u0026 Crypto Exchange - BitBay\r\nes.evobanco.bancamovil EVO Banco móvil\r\ncom.bankinter.portugal.bmb Bankinter Portugal\r\ncom.google.android.gm Gmail\r\npt.bancobest.android.mobilebanking Best Bank\r\ncom.wavesplatform.wallet Waves.Exchange\r\nnet.bitstamp.app Bitstamp – Buy \u0026 Sell Bitcoin at Crypto Exchange\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 4 of 28\n\nPackage Name App Name\r\nes.bancosantander.apps Santander\r\ncom.microsoft.office.outlook Microsoft Outlook: Organize Your Email \u0026 Calendar\r\ncom.okinc.okex.gp OKEx - Bitcoin/Crypto Trading Platform\r\ncom.grupocajamar.wefferent Grupo Cajamar\r\ncom.bankinter.launcher Bankinter Móvil\r\nes.cm.android Bankia\r\npt.novobanco.nbapp NB smart app\r\ncom.cajaingenieros.android.bancamovil Caja de Ingenieros Banca MÓVIL\r\nes.ibercaja.ibercajaapp Ibercaja\r\npt.santandertotta.mobileempresas Santander Empresas\r\nes.pibank.customers Pibank\r\npiuk.blockchain.android Blockchain Wallet. Bitcoin, Bitcoin Cash, Ethereum\r\ncom.indra.itecban.mobile.novobanco NBapp Spain\r\ncom.mediolanum Banco Mediolanum España\r\ncom.android.vending Google Play\r\ncom.bbva.mobile.pt BBVA Portugal\r\ncom.squareup.cash Cash App\r\nes.caixagalicia.activamovil ABANCA- Banca Móvil\r\nes.univia.unicajamovil UnicajaMovil\r\norg.electrum.electrum Electrum Bitcoin Wallet\r\napp.wizink.es WiZink, tu banco senZillo\r\ncom.yahoo.mobile.client.android.mail Yahoo Mail – Organized Email\r\ncgd.pt.caixadirectaparticulares Caixadirecta\r\ncom.connectivityapps.hotmail Connect for Hotmail \u0026 Outlook: Mail and Calendar\r\ncom.mail.mobile.android.mail mail.com mail\r\ncom.imaginbank.app imaginBank - Your mobile bank\r\nes.caixaontinyent.caixaontinyentapp Caixa Ontinyent\r\nwww.ingdirect.nativeframe ING España. Banca Móvil\r\neu.atlantico.bancoatlanticoapp MY ATLANTICO\r\ncom.bbva.bbvacontigo BBVA Spain\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 5 of 28\n\nPackage Name App Name\r\ncom.citi.mobile.ccc CitiManager – Corporate Cards\r\nca.mobile.explorer CA Mobile\r\ncom.paypal.android.p2pmobile PayPal Mobile Cash: Send and Request Money Fast\r\ncom.rsi ruralvía\r\nes.cecabank.ealia2103appstore UniPay Unicaja\r\nwit.android.bcpBankingApp.activoBank ActivoBank\r\ncom.indra.itecban.triodosbank.mobile.banki -\r\nes.lacaixa.mobile.android.newwapicon CaixaBank\r\ncom.db.pbc.mibanco Mi Banco db\r\ncom.targoes_prod.bad TARGOBANK - Banca a distancia\r\nErmac.A Targets\r\nPackage Name App Name\r\neu.inmite.prj.kb.mobilbank Mobilni Banka\r\ncom.greater.Greater Greater Bank\r\nuk.co.tsb.newmobilebank TSB Mobile Banking\r\norg.microemu.android.model.common.VTUserApplicationLINKMB Link Celular\r\nes.lacaixa.mobile.android.newwapicon CaixaBank\r\ncom.IngDirectAndroid ING France\r\nes.bancosantander.apps Santander\r\ncom.ocito.cdn.activity.creditdunord Crédit du Nord pour Mobile\r\npl.ideabank.mobilebanking Idea Bank PL\r\ngt.com.bi.bienlinea Bi en Línea\r\norg.banking.bsa.businessconnect BankSA Business App\r\npl.envelobank.aplikacja EnveloBank\r\nnet.inverline.bancosabadell.officelocator.android Banco Sabadell App. Your mobile bank\r\ncom.msf.kbank.mobile Kotak - 811 \u0026 Mobile Banking\r\nau.com.ingdirect.android ING Australia Banking\r\ncom.getingroup.mobilebanking Getin Mobile\r\nau.com.amp.myportfolio.android My AMP\r\ncom.magiclick.odeabank Odeabank\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 6 of 28\n\nPackage Name App Name\r\ncom.mtel.androidbea BEA 東亞銀行\r\neu.eleader.mobilebanking.pekao.firm PekaoBiznes24\r\norg.banking.stg.businessconnect St.George Business App\r\nsoftax.pekao.powerpay PeoPay\r\ncom.rsi ruralvía\r\nmy.com.hsbc.hsbcmalaysia HSBC Malaysia\r\ncom.td TD Canada\r\norg.banksa.bank BankSA Mobile Banking\r\norg.bom.bank Bank of Melbourne Mobile Banking\r\ncom.zoluxiones.officebanking Banco Santander Perú S.A.\r\ncom.pcfinancial.mobile Simplii Financial\r\nes.evobanco.bancamovil EVO Banco móvil\r\ncom.latuabancaperandroid Intesa Sanpaolo Mobile\r\ncom.fusion.beyondbank Beyond Bank Australia\r\ncom.rbs.mobile.android.rbs Royal Bank of Scotland Mobile Banking\r\ncom.unicredit Mobile Banking UniCredit\r\ncom.tarjetanaranja.emisor.serviciosClientes.appTitulares Naranja\r\nau.com.newcastlepermanent NPBS Mobile Banking\r\nau.com.suncorp.SuncorpBank Suncorp Bank\r\nde.traktorpool tractorpool\r\nhu.cardinal.erste.mobilapp Erste Business MobilBank\r\nau.com.bankwest.mobile Bankwest\r\nit.popso.SCRIGNOapp SCRIGNOapp\r\nde.dkb.portalapp DKB-Banking\r\npe.com.interbank.mobilebanking Interbank APP\r\nit.copergmps.rt.pf.android.sp.bmps Banca MPS\r\nde.consorsbank Consorsbank\r\ncom.isis_papyrus.raiffeisen_pay_eyewdg Raiffeisen ELBA\r\nde.fiducia.smartphone.android.banking.vr VR Banking Classic\r\ncom.pozitron.iscep İşCep - Mobile Banking\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 7 of 28\n\nPackage Name App Name\r\nwit.android.bcpBankingApp.millenniumPL Bank Millennium\r\nes.ibercaja.ibercajaapp Ibercaja\r\nalior.bankingapp.android Usługi Bankowe\r\ncom.krungsri.kma KMA\r\nit.ingdirect.app ING Italia\r\ncom.mobillium.papara Papara\r\nde.adesso_mobile.secureapp.netbank SecureApp netbank\r\ncom.nearform.ptsb permanent tsb\r\ncom.konylabs.cbplpat Citi Handlowy\r\ncom.lynxspa.bancopopolare YouApp\r\ntr.com.sekerbilisim.mbank ŞEKER MOBİL ŞUBE\r\ncom.appfactory.tmb Teachers Mutual Bank\r\nau.com.mebank.banking ME Bank\r\ncom.kasikorn.retail.mbanking.wap K PLUS\r\ncom.infrasofttech.MahaBank Maha Mobile\r\ncom.pttfinans PTTBank\r\nes.univia.unicajamovil UnicajaMovil\r\nau.com.commbank.commbiz.prod CommBiz\r\nmy.com.maybank2u.m2umobile Maybank2u MY\r\nes.pibank.customers Pibank\r\nde.ingdiba.bankingapp ING Banking to go\r\ncom.fusion.banking Bank Australia app\r\ncom.tecnocom.cajalaboral Banca Móvil Laboral Kutxa\r\npegasus.project.ebh.mobile.android.bundle.mobilebank George Magyarország\r\nau.com.rams.RAMS myRAMS\r\ncom.teb CEPTETEB\r\neu.netinfo.colpatria.system Scotiabank Colpatria\r\nde.santander.presentation Santander Banking\r\nes.openbank.mobile Openbank – banca móvil\r\npl.raiffeisen.nfc Mobilny Portfel\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 8 of 28\n\nPackage Name App Name\r\npt.novobanco.nbapp NB smart app\r\nuk.co.metrobankonline.mobile.android.production Metro Bank\r\ncom.tmobtech.halkbank Halkbank Mobil\r\nde.mobile.android.app mobile.de – Germany‘s largest car market\r\nnet.bnpparibas.mescomptes Mes Comptes BNP Paribas\r\ncom.mercadolibre Mercado Libre: compra fácil y rápido\r\nuk.co.mbna.cardservices.android MBNA - Card Services App\r\nhu.cardinal.cib.mobilapp CIB Business Online\r\nfr.creditagricole.androidapp Ma Banque\r\njp.co.rakuten_bank.rakutenbank 楽天銀行 -個人のお客様向けアプリ\r\norg.banking.bom.businessconnect Bank of Melbourne Business App\r\npl.ing.mojeing Moje ING mobile\r\npl.pkobp.ipkobiznes iPKO biznes\r\ncom.usbank.mobilebanking U.S. Bank - Inspired by customers\r\npl.pkobp.iko IKO\r\ncom.anz.transactive.global ANZ Transactive - Global\r\ncom.bankofqueensland.boq BOQ Mobile\r\ncom.ingbanktr.ingmobil ING Mobil\r\ncom.tdbank TD Bank (US)\r\ncom.scb.phone SCB EASY\r\ncom.Version1 PNB ONE\r\nnet.garagecoders.e_llavescotiainfo ScotiaMóvil\r\nnz.co.asb.asbmobile ASB Mobile Banking\r\ncom.finanteq.finance.bgz BNP Paribas GOMobile\r\ncom.woodforest Woodforest Mobile Banking\r\nro.btrl.mobile Banca Transilvania\r\nuk.co.hsbc.hsbcukmobilebanking HSBC UK Mobile Banking\r\ncom.todo1.mobile Bancolombia App Personas\r\ncom.uy.itau.appitauuypf Itaú Uruguay\r\ncom.key.android KeyBank Mobile\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 9 of 28\n\nPackage Name App Name\r\nit.bnl.apps.banking BNL\r\nau.com.cua.mb CUA Mobile Banking\r\ncom.ykb.android Yapı Kredi Mobile\r\nktbcs.netbank Krungthai NEXT\r\ncom.santander.bpi Santander Private Banking\r\nposteitaliane.posteapp.apppostepay Postepay\r\nuk.co.tescomobile.android Tesco Mobile\r\nes.ceca.cajalnet Cajalnet\r\ncom.scotiabank.banking Scotiabank Mobile Banking\r\nit.nogood.container UBI Banca\r\npl.noblebank.mobile Noble Mobile\r\ncom.suntrust.mobilebanking SunTrust Mobile App\r\npl.eurobank2 eurobank mobile 2.0\r\ncom.mobileloft.alpha.droid myAlpha Mobile\r\ncom.unionbank.ecommerce.mobile.android Union Bank Mobile Banking\r\npl.millennium.corpApp Bank Millennium for Companies\r\nau.com.hsbc.hsbcaustralia HSBC Australia\r\ncom.starfinanz.smob.android.sfinanzstatus Sparkasse Ihre mobile Filiale\r\norg.westpac.col Westpac Corporate Mobile\r\nau.com.macquarie.banking Macquarie Mobile Banking\r\nfinansbank.enpara Enpara.com Cep Şubesi\r\norg.stgeorge.bank St.George Mobile Banking\r\ncom.mcom.firstcitizens First Citizens Mobile Banking\r\nfr.laposte.lapostemobile La Poste - Services Postaux\r\nes.bancosantander.empresas Santander Empresas\r\nfr.lcl.android.customerarea Mes Comptes - LCL\r\nfr.banquepopulaire.cyberplus Banque Populaire\r\nuk.co.santander.santanderUK Santander Mobile Banking\r\ncom.comarch.mobile.banking.bgzbnpparibas.biznes Mobile BiznesPl@net\r\npl.fakturownia Fakturownia.pl\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 10 of 28\n\nPackage Name App Name\r\npt.bancobpi.mobile.fiabilizacao BPI APP\r\nde.commerzbanking.mobil Commerzbank Banking - The app at your side\r\nde.comdirect.android comdirect mobile App\r\ncom.kutxabank.android Kutxabank\r\npt.santandertotta.mobileparticulares Santander Particulares\r\nes.caixageral.caixageralapp Banco Caixa Geral España\r\ncom.itau.empresas\r\nItaú Empresas: Controle e Gestão do seu\r\nNegócio\r\nwit.android.bcpBankingApp.millennium Millenniumbcp\r\ncom.sbi.SBIFreedomPlus Yono Lite SBI - Mobile Banking\r\nfr.oney.mobile.mescomptes Oney France\r\npl.bzwbk.bzwbk24 Santander mobile\r\ncom.vancity.mobileapp Vancity\r\ncom.comarch.security.mobilebanking ING Business\r\ncom.snapwork.hdfc HDFC Bank MobileBanking\r\nes.caixagalicia.activamovil ABANCA- Banca Móvil\r\ntsb.mobilebanking TSB Bank Mobile Banking\r\ncom.zellepay.zelle Zelle\r\nma.gbp.pocketbank Pocket Bank\r\nde.postbank.finanzassistent Postbank Finanzassistent\r\ncom.bendigobank.mobile Bendigo Bank\r\nes.liberbank.cajasturapp Banca Digital Liberbank\r\nhu.bb.mobilapp Budapest Bank Mobil App\r\ncom.pnc.ecommerce.mobile PNC Mobile\r\neu.atlantico.bancoatlanticoapp MY ATLANTICO\r\npl.bps.bankowoscmobilna BPS Mobilnie\r\neu.unicreditgroup.hvbapptan HVB Mobile Banking\r\ncom.konylabs.HongLeongConnect Hong Leong Connect Mobile Banking\r\npl.aliorbank.aib Alior Mobile\r\ncom.mfoundry.mb.android.mb_136 People’s United Bank Mobile\r\nau.com.ubank.internetbanking UBank Mobile Banking\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 11 of 28\n\nPackage Name App Name\r\nde.number26.android N26 — The Mobile Bank\r\ncz.csob.smartbanking ČSOB Smartbanking\r\nmobi.societegenerale.mobile.lappli L’Appli Société Générale\r\ncom.vakifbank.mobile VakıfBank Mobil Bankacılık\r\ncom.anz.android.gomoney ANZ Australia\r\nmbanking.NBG NBG Mobile Banking\r\npl.bph BusinessPro Lite\r\ncom.finanteq.finance.ca CA24 Mobile\r\ncom.quoine.quoinex.light\r\nLiquid by Quoineライト版（リキッドバイコ\r\nイン） -ビットコインなどの仮想通貨取引\r\n所\r\nenterprise.com.anz.shield ANZ Shield\r\npl.bzwbk.ibiznes24 iBiznes24 mobile\r\ntr.com.hsbc.hsbcturkey HSBC Turkey\r\ncom.kuveytturk.mobil Kuveyt Türk\r\ncom.ziraat.ziraatmobil Ziraat Mobile\r\ncom.targo_prod.bad TARGOBANK Mobile Banking\r\nau.com.nab.mobile NAB Mobile Banking\r\ncom.samba.mb SambaMobile\r\norg.westpac.bank Westpac Mobile Banking\r\npl.ifirma.ifirmafaktury IFIRMA - Darmowy Program do Faktur\r\ncom.rbc.mobile.android RBC Mobile\r\ncom.tideplatform.banking Tide - Smart Mobile Banking\r\ncom.sbi.SBAnywhereCorporate SBI Anywhere Corporate\r\nhu.mkb.mobilapp MKB Mobilalkalmazás\r\ncom.todo1.davivienda.mobileapp Davivienda Móvil\r\njp.co.netbk 住信SBIネット銀行\r\ncom.navyfederal.android Navy Federal Credit Union\r\ncom.infrasofttech.CentralBank Cent Mobile\r\ncom.konylabs.capitalone Capital One® Mobile\r\nes.cm.android Bankia\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 12 of 28\n\nPackage Name App Name\r\npl.mbank mBank PL\r\ncom.wf.wellsfargomobile Wells Fargo Mobile\r\ngr.winbank.mobilenext Winbank Mobile\r\ncom.westernunion.moneytransferr3app.es\r\nWestern Union ES - Send Money Transfers\r\nQuickly\r\ncom.snapwork.IDBI IDBI Bank GO Mobile+\r\ncom.commbank.netbank CommBank\r\nmx.bancosantander.supermovil Santander móvil\r\ncom.rbs.mobile.android.natwest NatWest Mobile Banking\r\nit.carige Carige Mobile\r\ncom.usaa.mobile.android.usaa USAA Mobile\r\neu.eleader.mobilebanking.pekao Pekao24Makler\r\nAnatsa.A Targets\r\nPackage Name App Name\r\nuk.co.hsbc.hsbcukmobilebanking HSBC UK Mobile Banking\r\ncom.chase.sig.android Chase Mobile\r\ncom.wf.wellsfargomobile Wells Fargo Mobile\r\ncom.citi.citimobile Citi Mobile®\r\ncom.konylabs.capitalone Capital One® Mobile\r\ncom.infonow.bofa Bank of America Mobile Banking\r\ncom.jpm.sig.android J.P. Morgan Mobile\r\ncom.usbank.mobilebanking U.S. Bank - Inspired by customers\r\ncom.truist.mobile Truist Mobile - Banking Made Better\r\ncom.pnc.ecommerce.mobile PNC Mobile\r\ncom.tdbank TD Bank (US)\r\ncom.schwab.mobile Schwab Mobile\r\ncom.statestreetbank.grip State Street Bank\r\nus.hsbc.hsbcus HSBC US\r\ncom.citizensbank.androidapp Citizens Bank Mobile Banking\r\ncom.syf.synchronybank Synchrony Bank\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 13 of 28\n\nPackage Name App Name\r\ncom.creditonebank.mobile Credit One Bank Mobile\r\ncom.monitise.client.android.clydesdale Clydesdale Bank Mobile Banking\r\ncom.fidelity.android Fidelity Investments\r\nus.current.android\r\nEarn Cash Reward: Make Money Playing Games \u0026\r\nMusic\r\ncom.robinhood.android Robinhood - Investment \u0026 Trading, Commission-free\r\ncom.moneylion MoneyLion: Mobile Banking App\r\ncom.sablemoney.sableapp.prod Sable\r\ncom.virginmoney.uk.mobile.android Virgin Money Mobile Banking\r\ncom.monitise.client.android.yorkshire Yorkshire Bank Mobile Banking\r\ncom.monitise.client.android.clydesdale Clydesdale Bank Mobile Banking\r\ncom.algorand.android Algorand Wallet\r\ncom.coinbase.android Coinbase – Buy \u0026 Sell Bitcoin. Crypto Wallet\r\nco.mona.android Crypto.com - Buy Bitcoin Now\r\ncom.monese.monese.live Monese - Mobile Money Account for UK \u0026 Europe\r\ncom.binance.dev Binance - Buy \u0026 Sell Bitcoin Securely\r\ncom.danskebank.mobilebank3.uk Mobile Bank UK – Danske Bank\r\ncom.rbs.mobile.android.ubn Ulster Bank NI Mobile Banking\r\ncom.rbs.mobile.android.natwest NatWest Mobile Banking\r\ncom.rbs.mobile.android.natwestoffshore NatWest International\r\ncom.plunien.poloniex Poloniex Crypto Exchange\r\ncom.wallet.crypto.trustapp Trust: Crypto \u0026 Bitcoin Wallet\r\ncom.cooperativebank.bank The Co-operative Bank\r\nuk.co.metrobankonline.mobile.android.production Metro Bank\r\ncom.starlingbank.android Starling Bank - Better Mobile Banking\r\nio.metamask MetaMask - Buy, Send and Swap Crypto\r\nco.uk.getmondo Monzo Bank\r\ncom.binance.us Binance.US\r\ncom.kraken.invest.app Kraken - Buy Bitcoin \u0026 Crypto\r\ncom.blockfolio.blockfolio Blockfolio - Bitcoin and Cryptocurrency Tracker\r\ncom.gemini.android.app Gemini: Buy Bitcoin Instantly\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 14 of 28\n\nPackage Name App Name\r\ncom.okinc.okcoin.intl Okcoin - Buy \u0026 Trade Bitcoin, Ethereum, \u0026 Crypto\r\ncom.barclays.android.barclaysmobilebanking Barclays\r\ncom.tideplatform.banking Tide - Smart Mobile Banking\r\ncom.grppl.android.shell.halifax Halifax: the banking app that gives you extra\r\ncom.grppl.android.shell.CMBlloydsTSB73 Lloyds Bank Mobile Banking: by your side\r\ncom.usaa.mobile.android.usaa USAA Mobile\r\ncom.blockfi.mobile BlockFi - Buy, Earn, Borrow Crypto\r\ncom.marcus.android Marcus by Goldman Sachs®\r\ncom.unionbank.ecommerce.mobile.android Union Bank Mobile Banking\r\norg.penfed.mobile.banking PenFed\r\ncom.navyfederal.android Navy Federal Credit Union\r\ncom.stash.stashinvest Stash: Invest, Bank, Save\r\ncom.regions.mobbanking Regions Bank\r\ncom.varomoney.bank Varo Bank: Mobile Banking\r\ncom.current.app Current - Modern Banking\r\ncom.huntington.m Huntington Mobile\r\ncom.clairmail.fth Fifth Third Mobile Banking\r\ncom.mint Mint: Personal Finance Manager\r\npiuk.blockchain.android Blockchain Wallet. Bitcoin, Bitcoin Cash, Ethereum\r\ncom.q2e.texasdowcreditunion5004401st.mobile.production TDECU Digital Banking\r\npr.com.firstbank FirstBank Digital Banking App\r\ncom.oneazcu.banking OneAZ Mobile Banking\r\ncom.axos.udb Axos Bank®\r\ncom.etrade.mobilepro.activity E*TRADE: Invest. Trade. Save.\r\norg.suncoast.mobile Suncoast SunMobile\r\ncom.firsttech.firsttech First Tech Federal CU\r\norg.ncsecu.mobile SECU\r\norg.ncsecu.mobile SECU\r\ncom.softek.ofxclmobile.warrenfcu Blue FCU Mobile Banking App\r\ncom.bethpage.bethpage Bethpage Mobile Banking\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 15 of 28\n\nPackage Name App Name\r\ncom.myoccu.mobile MyOCCU Mobile Banking\r\ncom.ifs.banking.fiid3160 Tru2Go Truliant Mobile Banking\r\ncom.desertschools.mobilebanking Desert Financial Mobile\r\ncom.nymfcu.nymfcu NYMCU Mobile Banking\r\ncom.softek.ofxclmobile.summitcu Summit Credit Union Mobile\r\ncom.fi7453.godough PFFCU Mobile Banking\r\ncom.cuamerica.cuamerica Credit Union of America\r\ncom.ifs.banking.fiid3337 Arizona Federal Mobile Banking\r\ncom.ksfcu.ksfcu Valley Strong DataMobile\r\ncom.ifs.mobilebanking.fiid9094 Service CU Mobile Banking\r\ncom.scottcreditunion5029.mobile Scott Credit Union\r\ncom.socalcu.socalcu CU SoCal Mobile Banking\r\ncom.q2e.unitedfcu5017android.ufcu.uwnmobile United Federal Credit Union\r\ncom.credituniononecu.credituniononecu NEW - Credit Union One Michigan\r\nmobile.dcfcu.org DCFCU Mobile\r\ncom.ifs.mobilebanking.fiid3919 Associated Credit Union Mobile\r\ncom.ifs.banking.fiid1359 WPCU Mobile Banking\r\ncom.growfinancialfcu.growfinancialfcu Grow Mobile Banking\r\ncom.nexowallet Nexo - Crypto Banking Account\r\ncom.investvoyager Voyager: Crypto Made Simple\r\ncom.mobileloft.alpha.droid myAlpha Mobile\r\nmbanking.NBG NBG Mobile Banking\r\ncom.vivawallet.business Viva Wallet\r\ngr.winbank.mobilenext Winbank Mobile\r\ncom.EurobankEFG Eurobank Mobile App\r\nio.sperax.wallet Sperax Play\r\nru.sberbankmobile Сбербанк Онлайн\r\nru.otpbank.mobile ОТП Банк\r\nru.letobank.Prometheus Почта Банк\r\nge.lb.mobilebank Liberty\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 16 of 28\n\nPackage Name App Name\r\ncom.idamob.tinkoff.android Tinkoff\r\nru.bankuralsib.mb.android Мобильный банк УРАЛСИБ\r\ngr.nbg.go4more go4more\r\ncom.ubanksu UBANK\r\nru.vtb24.mobilebanking.android VTB-Online\r\ncom.mtbank Мой банк\r\ncom.columbiabank3685.mobile.production Columbia Bank\r\ncom.capital.etf.trade Investments - Capital.com\r\nch.raiffeisen.twint Raiffeisen TWINT\r\nch.postfinance.twint.android PostFinance TWINT\r\ncom.csg.creditsuisse.twint Credit Suisse TWINT – mobile payment app\r\nch.postfinance.android PostFinance Mobile\r\ncom.csg.cs.dnmb Credit Suisse Direct\r\ncom.ubs.swidK2Y.android UBS Access – secure login for digital banking\r\ncom.ubs.swidKXJ.android UBS Mobile Banking: E-Banking and mobile pay\r\ncom.neonbanking.app neon - your account app\r\nch.raiffeisen.android Raiffeisen E-Banking\r\ncom.flowbank.client FlowBank\r\nch.bankcler.zak Bank Cler Zak\r\ncom.axa.android.smartclaims.ch MyAXA CH\r\nch.zkb.slv.mobile.client.android eBanking Mobile\r\ncom.swissborg.android SwissBorg: Invest in Crypto\r\nch.zkb.twint ZKB TWINT\r\nch.zkb.frankly frankly. Pillar 3a – Private pension\r\nch.bcv.mobile.android BCV Mobile\r\nat.rsg.pfp Mein ELBA-App\r\nat.erstebank.george George Österreich\r\nat.erstebank.securityapp s Identity\r\ncom.bawagpsk.bawagpsk BAWAG PSK klar – Mobile Banking App\r\ncom.bankaustria.android.olb Bank Austria MobileBanking\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 17 of 28\n\nPackage Name App Name\r\nat.tmobile.android.myt Mein Magenta (AT)\r\ncom.bitpanda.bitpanda Bitpanda - Buy Bitcoin in minutes\r\nat.volksbank.volksbankmobile Volksbank hausbanking\r\nat.ing.diba.client.onlinebanking ING Banking Austria\r\ncom.easybank.easybank easybank App\r\nat.oberbank.mbanking Oberbank\r\nde.xcom.flatexat flatex AT\r\ncom.cardcomplete.completecontrol complete Control\r\nat.bank99.meine.meine meine99 Online Banking\r\nat.bks.mbanking BKS Bank Österreich\r\nat.racon.mandantvkb VKB CONNECT\r\ncom.csiweb.digitalbanking.bk0617 Viking Bank Mobile\r\ncom.csiweb.digitalbanking.bk0710 Minnesota National Bank\r\ndk.bec.android.mb1.b00369.prod Spar Nord Mobilbank\r\ndk.bec.android.mb1.b00020.prod AL-Bank\r\ndk.jyskebank.drb Jyske Bank\r\ndk.landbobanken.drb Ringkjøbing Landbobank og Nordjyske Bank\r\ndk.bec.android.mb1.b00019.prod Vestjysk Bank\r\ndk.nordea.mobilebank Nordea Mobile - Denmark\r\ndk.sydbank.drb Sydbanks Mobilbank Privat\r\ncom.resurs.rbapp Resurs Bank\r\ncom.danskebank.mobilebank3.dk NY mobilbank DK - Danske Bank\r\nnz.co.cooperativebank The Co-operative Bank (NZ)\r\nnz.co.anz.android.mobilebanking ANZ goMoney New Zealand\r\nnz.co.asb.asbmobile ASB Mobile Banking\r\nnz.co.asb.asbmobile ASB Mobile Banking\r\nnz.co.kiwibank.mobile Kiwibank Mobile Banking\r\nnz.co.westpac Westpac One (NZ) Mobile Banking\r\ncom.commbank.netbank CommBank\r\nau.com.nab.mobile NAB Mobile Banking\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 18 of 28\n\nPackage Name App Name\r\ncom.anz.android.gomoney ANZ Australia\r\norg.westpac.bank Westpac Mobile Banking\r\ncom.bendigobank.mobile Bendigo Bank\r\nau.com.ingdirect.android ING Australia Banking\r\norg.stgeorge.bank St.George Mobile Banking\r\nau.com.bankwest.mobile Bankwest\r\ncom.coinspot.app CoinSpot - Buy \u0026 Sell Bitcoin\r\norg.banksa.bank BankSA Mobile Banking\r\nau.com.heritage.app Heritage Mobile Banking\r\norg.bom.bank Bank of Melbourne Mobile Banking\r\nau.com.cua.mb CUA Mobile Banking\r\nau.com.swyftx Swyftx Cryptocurrency Exchange - Buy, Sell \u0026 Trade\r\ncom.citibank.mobile.au Citibank Australia\r\nau.com.mebank.banking ME Bank\r\nau.com.newcastlepermanent NPBS Mobile Banking\r\ncom.fusion.beyondbank Beyond Bank Australia\r\ncom.bankofqueensland.boq BOQ Mobile\r\ncom.adcb.cbgdigi ADCB Hayyak: Start your banking relationship now!\r\ncom.cbd.mobile CBD\r\ncom.dib.app DIB MOBILE\r\ncom.mashreq.NeoApp Mashreq Neo - Bank easy\r\ncom.adcb.bank ADCB\r\nenbd.mobilebanking Emirates NBD\r\ncom.fab.personalbanking FAB Mobile\r\ncom.adib.mobile ADIB Mobile Banking App\r\ncom.rak RAKBANK Digital Banking\r\ncom.adib.smartmoney smartbanking by ADIB\r\ncom.alhilal.hayyak Ahlan by Al Hilal Bank\r\ncom.kubi.kucoin KuCoin: Bitcoin Exchange \u0026 Crypto Wallet\r\ncom.mbc.anb.keystore ANB Mobile~ Arab National Bank\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 19 of 28\n\nPackage Name App Name\r\ncom.phonepe.app PhonePe: UPI, Recharge, Investment, Insurance\r\ncom.rainmanagement.rain Rain: Buy \u0026 Sell Bitcoin\r\ncom.BanqueMisr.MobileBanking BM Online\r\ncom.riyadbank.strategic RiyadBank Mobile\r\nsa.liv.android Liv. KSA - Digital Banking\r\ncom.alahli.mobile.android SNB AlAhli Mobile\r\ncom.alrajhiretailapp Al Rajhi Mobile\r\ncom.samba.mb SambaMobile\r\ncom.sabb.mobilebanking SABBMobile\r\ncom.bsffm FransiMobile\r\ncom.alinma.retail.mobile Alinma Bank\r\ncom.saib.banking.mobile.android SAIB\r\ncom.slsp.mtoken SLSP mToken\r\nsk.slsp.georgego George Go Slovensko\r\nbank.sk365.app 365.bank\r\nsk.tb.ib.tatraandroid Tatra banka\r\nsk.csob.smarttoken CSOB SmartToken\r\ncom.zentity.sbank.csobsk SmartBanking\r\nsk.vub.mobile VÚB Mobile Banking\r\nsk.tb.emv.mobile Čítačka\r\nsk.raiffeisen.ib.androidwrapper Raiffeisen Bank SK\r\ncz.homecredit.hcsk Home Credit SK\r\ncom.zentity.pabk Poštová banka\r\nhr.asseco.android.jimba.mUCI.sk SmartBanking SK\r\nsk.mbank mBank SK\r\nsk.primabanka.penazenka Peňaženka\r\ncom.firstdirect.bankingonthego first direct\r\ncom.revolut.revolut Revolut - Get more from your money\r\ncom.outsystemsenterprise.thinkmoneyprod.ThinkMoney thinkmoney\r\ncom.vanso.gtbankapp GTBank\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 20 of 28\n\nPackage Name App Name\r\ncom.suntrust.mobilebanking SunTrust Mobile App\r\nHydra.C Targets\r\nPackage Name App Name\r\ncom.netflix.mediaclient Netflix\r\neu.inmite.prj.kb.mobilbank Mobilni Banka\r\ncom.bitfinex.mobileapp Bitfinex\r\ncom.google.android.gm Gmail\r\nes.lacaixa.mobile.android.newwapicon CaixaBank\r\nco.com.bbva.mb BBVA Colombia\r\ncom.albarakaapp Albaraka Mobile Banking\r\ncom.indra.itecban.triodosbank.mobile.banki -\r\nes.bancosantander.apps Santander\r\npl.ideabank.mobilebanking Idea Bank PL\r\npl.envelobank.aplikacja EnveloBank\r\nnet.inverline.bancosabadell.officelocator.android Banco Sabadell App. Your mobile bank\r\ncom.ambank.ambankonline AmOnline\r\ncom.liberty.jaxx Jaxx Liberty: Blockchain Wallet\r\ncom.yahoo.mobile.client.android.mail Yahoo Mail – Organized Email\r\npl.int.poczta INT Poczta\r\ncom.bitcoin.mwallet Bitcoin Wallet\r\ncom.cleverlance.csas.servis24 SERVIS 24 Mobilni banka\r\ncom.getingroup.mobilebanking Getin Mobile\r\norg.electrum.electrum Electrum Bitcoin Wallet\r\ncom.magiclick.odeabank Odeabank\r\ncom.akbank.android.apps.akbank_direkt Akbank\r\ncz.rb.app.smartphonebanking Mobilní eKonto Raiffeisenbank\r\ncom.db.pwcc.dbmobile Deutsche Bank Mobile\r\ncom.avuscapital.trading212 Trading 212 - Stocks, ETFs, Forex, Gold\r\nsoftax.pekao.powerpay PeoPay\r\ncom.binance.dev Binance - Buy \u0026 Sell Bitcoin Securely\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 21 of 28\n\nPackage Name App Name\r\ncom.rsi ruralvía\r\ncom.connectivityapps.hotmail Connect for Hotmail \u0026 Outlook: Mail and Calendar\r\nhuawei.settings.pin -\r\ncom.denizbank.mobildeniz MobilDeniz\r\ncom.grupoavalav1.bancamovil AV Villas App\r\nmy.com.hsbc.hsbcmalaysia HSBC Malaysia\r\neu.eleader.mobilebanking.pekao Pekao24Makler\r\ncom.bcp.bank.bcp Banca Móvil BCP\r\ncom.zoluxiones.officebanking Banco Santander Perú S.A.\r\ncom.indra.itecban.mobile.novobanco NBapp Spain\r\nes.evobanco.bancamovil EVO Banco móvil\r\ncom.rbs.mobile.android.rbs Royal Bank of Scotland Mobile Banking\r\nsamsung.settings.pin -\r\ncom.grupocajamar.wefferent Grupo Cajamar\r\ncom.samsung.android.email.provider Samsung Email\r\ncom.clairmail.fth Fifth Third Mobile Banking\r\ncom.hittechsexpertlimited.hitbtc HitBTC – Bitcoin Trading and Crypto Exchange\r\nde.dkb.portalapp DKB-Banking\r\nio.totalcoin.wallet Bitcoin Wallet Totalcoin - Buy and Sell Bitcoin\r\npe.com.interbank.mobilebanking Interbank APP\r\ncz.fio.sb2 Fio Smartbanking CZ\r\nes.caixaontinyent.caixaontinyentapp Caixa Ontinyent\r\nde.fiducia.smartphone.android.banking.vr VR Banking Classic\r\ncom.polehin.android Bitcoin Wallet - Buy BTC\r\ncom.pozitron.iscep İşCep - Mobile Banking\r\ncom.cajaingenieros.android.bancamovil Caja de Ingenieros Banca MÓVIL\r\nwit.android.bcpBankingApp.millenniumPL Bank Millennium\r\nes.ibercaja.ibercajaapp Ibercaja\r\nalior.bankingapp.android Usługi Bankowe\r\npl.interia.poczta_next Nowa Poczta Interia\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 22 of 28\n\nPackage Name App Name\r\ncom.mobillium.papara Papara\r\ncom.uphold.wallet Uphold - Trade, Invest, Send Money For Zero Fees\r\npl.cinkciarz Currency Exchange Conotoxia\r\ncom.nearform.ptsb permanent tsb\r\ncom.db.mm.norisbank norisbank App\r\ncom.konylabs.cbplpat Citi Handlowy\r\ntr.com.sekerbilisim.mbank ŞEKER MOBİL ŞUBE\r\ncz.csob.smartbanking.era Smartbanking PS\r\ncom.citi.citimobile Citi Mobile®\r\npl.onet.mail Onet Poczta - e-mail app\r\ncom.cooperativebank.bank The Co-operative Bank\r\ncz.equabank.mobilebanking Equa bank\r\ncom.pttfinans PTTBank\r\nes.univia.unicajamovil UnicajaMovil\r\ncom.garanti.cepsubesi Garanti BBVA Mobile\r\nmy.com.maybank2u.m2umobile Maybank2u MY\r\ncz.seznam.email Email.cz\r\nes.pibank.customers Pibank\r\ncom.coinbase.android Coinbase – Buy \u0026 Sell Bitcoin. Crypto Wallet\r\nde.ingdiba.bankingapp ING Banking to go\r\ncom.bancodebogota.bancamovil Banco de Bogotá\r\ncom.tecnocom.cajalaboral Banca Móvil Laboral Kutxa\r\ncom.teb CEPTETEB\r\neu.netinfo.colpatria.system Scotiabank Colpatria\r\ncom.btcturk.pro BtcTurk PRO - Bitcoin Al-Sat\r\ncom.citibanamex.banamexmobile Citibanamex Móvil\r\nio.cex.app.prod CEX.IO Cryptocurrency Exchange\r\ncom.plunien.poloniex Poloniex Crypto Exchange\r\npl.raiffeisen.nfc Mobilny Portfel\r\nes.openbank.mobile Openbank – banca móvil\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 23 of 28\n\nPackage Name App Name\r\nuk.co.metrobankonline.mobile.android.production Metro Bank\r\ncom.tmobtech.halkbank Halkbank Mobil\r\nuk.co.mbna.cardservices.android MBNA - Card Services App\r\npl.wp.wppoczta WP Poczta\r\npl.ing.mojeing Moje ING mobile\r\ncom.citibank.CitibankMY Citibank MY\r\npl.pkobp.iko IKO\r\npl.wp.pocztao2 Poczta o2\r\ncom.ingbanktr.ingmobil ING Mobil\r\ncom.tdbank TD Bank (US)\r\nom.instagram.android -\r\ncash.klever.blockchain.wallet Klever Wallet: Buy Bitcoin, Ethereum, Tron, Crypto\r\ncom.finansbank.mobile.cepsube QNB Finansbank Mobile Banking\r\ncom.myetherwallet.mewwallet MEW wallet – Ethereum wallet\r\ncom.finanteq.finance.bgz BNP Paribas GOMobile\r\ncom.moneybookers.skrillpayments.neteller NETELLER - fast, secure and global money transfers\r\ncom.grppl.android.shell.halifax Halifax: the banking app that gives you extra\r\ncz.mbank mBank CZ\r\ncom.grupoavaloc1.bancamovil Banco de Occidente Móvil\r\ncz.fio.android.smartbroker Fio Smartbroker\r\ncom.todo1.mobile Bancolombia App Personas\r\nuk.co.hsbc.hsbcukmobilebanking HSBC UK Mobile Banking\r\ncom.ubercab Uber - Request a ride\r\ncom.Bither.one Bither\r\ncom.electroneum.mobile Electroneum\r\ncom.ykb.android Yapı Kredi Mobile\r\ncom.alibaba.aliexpresshd AliExpress - Smarter Shopping, Better Living\r\nuk.co.tescomobile.android Tesco Mobile\r\ncom.microsoft.office.outlook Microsoft Outlook: Organize Your Email \u0026 Calendar\r\ncom.amazon.mShop.android.shopping Amazon Shopping - Search, Find, Ship, and Save\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 24 of 28\n\nPackage Name App Name\r\npl.nestbank.nestbank Nest Bank nowy\r\npl.noblebank.mobile Noble Mobile\r\ncom.suntrust.mobilebanking SunTrust Mobile App\r\napp.wizink.es WiZink, tu banco senZillo\r\nco.bitx.android.wallet Luno: Buy Bitcoin, Ethereum and Cryptocurrency\r\ncom.grppl.android.shell.BOS Bank of Scotland Mobile Banking: secure on the go\r\ncz.csob.ceb ČSOB CEB Mobile\r\ncom.starfinanz.smob.android.sfinanzstatus Sparkasse Ihre mobile Filiale\r\nfinansbank.enpara Enpara.com Cep Şubesi\r\neu.eleader.mobilebanking.invest plusbank24\r\nes.bancosantander.empresas Santander Empresas\r\ncom.bitpay.wallet BitPay – Secure Bitcoin Wallet\r\ncom.okinc.okex.gp OKEx - Bitcoin/Crypto Trading Platform\r\nuk.co.santander.santanderUK Santander Mobile Banking\r\ncom.comarch.mobile.banking.bgzbnpparibas.biznes Mobile BiznesPl@net\r\ntr.gov.turkiye.edevlet.kapisi e-Devlet Kapısı\r\ncz.csas.georgego George Česká spořitelna\r\ncom.grppl.android.shell.CMBlloydsTSB73 Lloyds Bank Mobile Banking: by your side\r\nde.commerzbanking.mobil Commerzbank Banking - The app at your side\r\ncom.mail.mobile.android.mail mail.com mail\r\ncom.discoverfinancial.mobile Discover Mobile\r\nde.comdirect.android comdirect mobile App\r\nes.santander.Criptocalculadora Criptocalculadora\r\ncom.kutxabank.android Kutxabank\r\ncom.targoes_prod.bad TARGOBANK - Banca a distancia\r\ncz.airbank.android My Air\r\npe.pichincha.bm APP Banco Pichincha Perú\r\ncom.bbva.netcash BBVA Net Cash: ES \u0026 PT\r\ncom.paypal.android.p2pmobile PayPal Mobile Cash: Send and Request Money Fast\r\ncom.android.vending Google Play\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 25 of 28\n\nPackage Name App Name\r\npl.bzwbk.bzwbk24 Santander mobile\r\ncom.bbva.bbvacontigo BBVA Spain\r\npayumoney.merchantap -\r\ncom.comarch.security.mobilebanking ING Business\r\nus.zoom.videomeetings ZOOM Cloud Meetings\r\ncom.bbva.nxt_peru BBVA Perú  \r\ncom.Plus500 Plus500: CFD Online Trading on Forex and Stocks\r\ncom.thanksmister.bitcoin.localtrader Local Trader for LocalBitcoins\r\ncom.ubercab.eats Uber Eats: Food Delivery\r\ncom.bancocajasocial.geolocation Banco Caja Social Móvil\r\nes.caixagalicia.activamovil ABANCA- Banca Móvil\r\nde.postbank.finanzassistent Postbank Finanzassistent\r\ntsb.mobilebanking TSB Bank Mobile Banking\r\nes.liberbank.cajasturapp Banca Digital Liberbank\r\ncom.yoox YOOX - Fashion, Design and Art\r\ncom.bitmarket.trader Aplikacja Bitmarket\r\nmobile.santander.de Santander Mobile Banking\r\ncom.pnc.ecommerce.mobile PNC Mobile\r\npl.bps.bankowoscmobilna BPS Mobilnie\r\ncom.btcturk BtcTurk Bitcoin Borsası\r\ncom.bankinter.launcher Bankinter Móvil\r\neu.unicreditgroup.hvbapptan HVB Mobile Banking\r\npl.sgb.wallet PORTFEL SGB\r\ncom.bankia.wallet Bankia Wallet\r\ncom.cimbmalaysia CIMB Clicks Malaysia\r\ncom.whatsapp WhatsApp Messenger\r\ncom.konylabs.HongLeongConnect Hong Leong Connect Mobile Banking\r\nnet.bitstamp.app Bitstamp – Buy \u0026 Sell Bitcoin at Crypto Exchange\r\npl.aliorbank.aib Alior Mobile\r\ncom.facebook.katana Facebook\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 26 of 28\n\nPackage Name App Name\r\ncz.csob.smartbanking ČSOB Smartbanking\r\ncom.vakifbank.mobile VakıfBank Mobil Bankacılık\r\ncom.mediolanum Banco Mediolanum España\r\ncom.kraken.trade Pro: Advanced Bitcoin \u0026 Crypto Trading\r\ncom.ally.MobileBanking Ally Mobile\r\npe.com.scotiabank.blpm.android.client Scotiabank Perú\r\npl.bph BusinessPro Lite\r\nhr.asseco.android.jimba.mUCI.cz Smart Banking\r\ncom.cajasur.android Cajasur\r\ncom.finanteq.finance.ca CA24 Mobile\r\ncz.moneta.smartbanka Smart Banka\r\nes.cecabank.ealia2103appstore UniPay Unicaja\r\ntr.com.hsbc.hsbcturkey HSBC Turkey\r\ncom.kuveytturk.mobil Kuveyt Türk\r\ncom.ebay.mobile eBay: Buy, sell, and save money on home essentials\r\ncom.ziraat.ziraatmobil Ziraat Mobile\r\ncom.targo_prod.bad TARGOBANK Mobile Banking\r\ncom.barclaycardus Barclays US\r\ncz.kb.mba.business Mobilní banka Business\r\ncom.todo1.davivienda.mobileapp Davivienda Móvil\r\nhr.asseco.android.jimba.mUCI.sme.cz Business Smart Banking\r\ncom.fibabanka.Fibabanka.mobile Fibabanka Mobile\r\ncom.konylabs.capitalone Capital One® Mobile\r\nsamsung.settings.pass -\r\nwww.ingdirect.nativeframe ING España. Banca Móvil\r\ncom.infonow.bofa Bank of America Mobile Banking\r\ncom.nanooqit.economiaemail Centrum.cz mail\r\nde.sdvrz.ihb.mobile.app SpardaApp\r\ncom.mycelium.wallet Mycelium Bitcoin Wallet\r\nes.cm.android Bankia\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 27 of 28\n\nPackage Name App Name\r\npl.mbank mBank PL\r\ncom.wf.wellsfargomobile Wells Fargo Mobile\r\nexodusmovement.exodus Exodus: Crypto Bitcoin Wallet\r\ncom.cmcmarkets.android.cfd CMC: CFD Trading\r\ncom.google.android.play.games Google Play Games\r\ncom.rbs.mobile.android.natwest NatWest Mobile Banking\r\ncz.csas.business24 BUSINESS 24 Mobilní banka\r\ncom.bbt.myfi U by BB\u0026T\r\ncom.usaa.mobile.android.usaa USAA Mobile\r\npiuk.blockchain.android Blockchain Wallet. Bitcoin, Bitcoin Cash, Ethereum\r\ncom.breadwallet BRD Bitcoin Wallet. Buy BTC Bitcoin Cash, Ethereum\r\ncom.engage.pbb.pbengage2my.release PB engage MY\r\nSource: https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nhttps://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html\r\nPage 28 of 28", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "origins": [ "web" ], "references": [ "https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html" ], "report_names": [ "deceive-the-heavens-to-cross-the-sea.html" ], "threat_actors": [ { "id": "8309f9cf-9abb-4ce3-aa1e-cda7d7f5c1b3", "created_at": "2022-10-25T16:07:23.729215Z", "updated_at": "2026-04-10T02:00:04.729076Z", "deleted_at": null, "main_name": "Indra", "aliases": [], "source_name": "ETDA:Indra", "tools": [ "Stardust" ], "source_id": "ETDA", "reports": null }, { "id": "8941e146-3e7f-4b4e-9b66-c2da052ee6df", "created_at": "2023-01-06T13:46:38.402513Z", "updated_at": "2026-04-10T02:00:02.959797Z", "deleted_at": null, "main_name": "Sandworm", "aliases": [ "IRIDIUM", "Blue Echidna", "VOODOO BEAR", "FROZENBARENTS", "UAC-0113", "Seashell Blizzard", "UAC-0082", "APT44", "Quedagh", "TEMP.Noble", "IRON VIKING", "G0034", "ELECTRUM", "TeleBots" ], "source_name": "MISPGALAXY:Sandworm", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "8d28f58b-5ea2-4450-a74a-4a1e39caba6e", "created_at": "2026-03-16T02:02:50.582318Z", "updated_at": "2026-04-10T02:00:03.777263Z", "deleted_at": null, "main_name": "COASTLIGHT", "aliases": [ "Gonjeshke Darande", "Indra", "Predatory Sparrow" ], "source_name": "Secureworks:COASTLIGHT", "tools": [], "source_id": "Secureworks", "reports": null }, { "id": "75108fc1-7f6a-450e-b024-10284f3f62bb", "created_at": "2024-11-01T02:00:52.756877Z", "updated_at": "2026-04-10T02:00:05.273746Z", "deleted_at": null, "main_name": "Play", "aliases": null, "source_name": "MITRE:Play", "tools": [ "Nltest", "AdFind", "PsExec", "Wevtutil", "Cobalt Strike", "Playcrypt", "Mimikatz" ], "source_id": "MITRE", "reports": null }, { "id": "3a0be4ff-9074-4efd-98e4-47c6a62b14ad", "created_at": "2022-10-25T16:07:23.590051Z", "updated_at": "2026-04-10T02:00:04.679488Z", "deleted_at": null, "main_name": "Energetic Bear", "aliases": [ "ATK 6", "Blue Kraken", "Crouching Yeti", "Dragonfly", "Electrum", "Energetic Bear", "G0035", "Ghost Blizzard", "Group 24", "ITG15", "Iron Liberty", "Koala Team", "TG-4192" ], "source_name": "ETDA:Energetic Bear", "tools": [ "Backdoor.Oldrea", "CRASHOVERRIDE", "Commix", "CrackMapExec", "CrashOverride", "Dirsearch", "Dorshel", "Fertger", "Fuerboos", "Goodor", "Havex", "Havex RAT", "Hello EK", "Heriplor", "Impacket", "Industroyer", "Karagany", "Karagny", "LightsOut 2.0", "LightsOut EK", "Listrix", "Oldrea", "PEACEPIPE", "PHPMailer", "PsExec", "SMBTrap", "Subbrute", "Sublist3r", "Sysmain", "Trojan.Karagany", "WSO", "Webshell by Orb", "Win32/Industroyer", "Wpscan", "nmap", "sqlmap", "xFrost" ], "source_id": "ETDA", "reports": null }, { "id": "a66438a8-ebf6-4397-9ad5-ed07f93330aa", "created_at": "2022-10-25T16:47:55.919702Z", "updated_at": "2026-04-10T02:00:03.618194Z", "deleted_at": null, "main_name": "IRON VIKING", "aliases": [ "APT44 ", "ATK14 ", "BlackEnergy Group", "Blue Echidna ", "CTG-7263 ", "ELECTRUM ", "FROZENBARENTS ", "Hades/OlympicDestroyer ", "IRIDIUM ", "Qudedagh ", "Sandworm Team ", "Seashell Blizzard ", "TEMP.Noble ", "Telebots ", "Voodoo Bear " ], "source_name": "Secureworks:IRON VIKING", "tools": [ "BadRabbit", "BlackEnergy", "GCat", "NotPetya", "PSCrypt", "TeleBot", "TeleDoor", "xData" ], "source_id": "Secureworks", "reports": null }, { "id": "3fff98c9-ad02-401d-9d4b-f78b5b634f31", "created_at": "2023-01-06T13:46:38.376868Z", "updated_at": "2026-04-10T02:00:02.949077Z", "deleted_at": null, "main_name": "Cleaver", "aliases": [ "G0003", "Operation Cleaver", "Op Cleaver", "Tarh Andishan", "Alibaba", "TG-2889", "Cobalt Gypsy" ], "source_name": "MISPGALAXY:Cleaver", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "219ddb41-2ea8-4121-8b63-8c762f7e15df", "created_at": "2023-01-06T13:46:39.384442Z", "updated_at": "2026-04-10T02:00:03.309654Z", "deleted_at": null, "main_name": "Predatory Sparrow", "aliases": [ "Indra", "Gonjeshke Darande" ], "source_name": "MISPGALAXY:Predatory Sparrow", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "b3e954e8-8bbb-46f3-84de-d6f12dc7e1a6", "created_at": "2022-10-25T15:50:23.339976Z", "updated_at": "2026-04-10T02:00:05.27483Z", "deleted_at": null, "main_name": "Sandworm Team", "aliases": [ "Sandworm Team", "ELECTRUM", "Telebots", "IRON VIKING", "BlackEnergy (Group)", "Quedagh", "Voodoo Bear", "IRIDIUM", "Seashell Blizzard", "FROZENBARENTS", "APT44" ], "source_name": "MITRE:Sandworm Team", "tools": [ "Bad Rabbit", "Mimikatz", "Exaramel for Linux", "Exaramel for Windows", "GreyEnergy", "PsExec", "Prestige", "P.A.S. Webshell", "AcidPour", "VPNFilter", "Neo-reGeorg", "Cyclops Blink", "SDelete", "Kapeka", "AcidRain", "Industroyer", "Industroyer2", "BlackEnergy", "Cobalt Strike", "NotPetya", "KillDisk", "PoshC2", "Impacket", "Invoke-PSImage", "Olympic Destroyer" ], "source_id": "MITRE", "reports": null } ], "ts_created_at": 1775434877, "ts_updated_at": 1775826694, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/8e4db419d9a04988d29ecd81a1e67131c1484114.pdf", "text": "https://archive.orkl.eu/8e4db419d9a04988d29ecd81a1e67131c1484114.txt", "img": "https://archive.orkl.eu/8e4db419d9a04988d29ecd81a1e67131c1484114.jpg" } }