# Deceive the Heavens to Cross the sea **threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html** November 2021 ## 300.000+ infections via Droppers on Google Play Store [The “Deceive the Heavens to Cross the sea” stratagem comes from the first chapter of the ‘Thirty-Six Stratagems’, a famous Chinese](https://en.wikipedia.org/wiki/Thirty-Six_Stratagems) collection of tactics and techniques used in politics, war and civil life. It translates to “hide in plain sight” or “mask your true goals”. ----- Android banking trojan actors have taken this stratagem to heart and have been very adaptable over years to new Google Play app store restrictions introduced to limit their operations. These restrictions include setting limitations on the use of certain (dangerous) app permissions, which play a big role in distributing or automating malware tactics. [In this blog we will discuss the recent techniques used to spread Android banking trojans via Google Play (MITRE T1475) resulting in](https://attack.mitre.org/techniques/T1475/) significant financial loss for targeted banks. We will also discuss the, sometimes forgotten, by-product of collecting contacts and keystrokes by Banking trojans, resulting in severe data leakage. ## Tactics used by threat actors What makes these Google Play distribution campaigns very difficult to detect from an automation (sandbox) and machine learning perspective is that dropper apps all have a very small malicious footprint. This small footprint is a (direct) consequence of the permission restrictions enforced by Google Play. [A good example is the modification introduced on November 13th, 2021 by Google, which limits the use of the Accessibility Services,](https://support.google.com/googleplay/android-developer/answer/10964491) which was abused by earlier dropper campaigns to automate and install apps without user consent. This policing by Google has forced actors to find ways to significantly reduce the footprint of dropper apps. Besides improved malware code efforts, Google Play distribution campaigns are also more refined than previous campaigns. For example, by introducing carefully planned small malicious code updates over a longer period in Google Play, as well as sporting a dropper C2 backend to fully match the theme of the dropper app (for example a working Fitness website for a workout focused app). To make themselves even more difficult to detect, the actors behind these dropper apps only manually activate the installation of the banking trojan on an infected device in case they desire more victims in a specific region of the world. This makes automated detection a much harder strategy to adopt by any organization. VirusTotal does not showcase the evolution of detections of antivirus products over time, but almost all campaigns have or had a 0/62 FUD score on VirusTotal at some point in time, confirming the difficulty of detecting dropper apps with a minimal footprint. ----- ## Families and statistics In the paragraphs below we outline the Modus Operandi (MO) of each of the families distributed recently via Google Play. Each of [these families has its own banking apps target list, which can be found in the Appendix.](https://www.threatfabric.com/blogs/google-play-droppers.html#appendix-targeted-apps) ## Anatsa campaign During the research dedicated to the distribution techniques of different malware families, our analysts found numerous droppers located in Google Play, designed to distribute specifically the banking trojan Anatsa. Anatsa was discovered by ThreatFabric in January 2021. ----- Anatsa is a rather advanced Android banking trojan with RAT and semi ATS capabilities. It can also perform classic overlay attacks in order to steal credentials, accessibility logging (capturing everything shown on the user’s screen), and keylogging. Previously [ThreatFabric reported cases when Anatsa was distributed side-by-side with Cabassous in smishing campaigns all over Europe. Our](https://www.threatfabric.com/blogs/smishing-campaign-in-nl-spreading-cabassous-and-anatsa.html) latest findings show that Anatsa now utilizes Google Play dropper apps. **Thousands of victims** We discovered the first dropper in June 2021 masquerading as an app for scanning documents. In total, ThreatFabric analysts were able to identify 6 Anatsa droppers published in Google Play since June 2021. These apps posed as QR code scanners, PDF scanners, and cryptocurrency apps. One dropper app was installed more than 50.000 times, with the combined total of installations of all droppers reaching more than 100.000 installations. ----- The process of infection with Anatsa looks like this: upon the start of installation from Google Play, the user is forced to update the app in order to continue using the app. In this moment, Anatsa payload is downloaded from the C2 server(s), and installed on the device of the unsuspecting victim. Actors behind it took care of making their apps look legitimate and useful. There are large numbers of positive reviews for the apps. The number of installations and presence of reviews may convince Android users to install the app. Moreover, these apps indeed possess the claimed functionality, after installation they do operate normally and further convince victim in their legitimacy. Despite the overwhelming number of installations, not every device that has these droppers installed will receive Anatsa, as the actors made efforts to target only regions of their interest. We will cover this and other technical details in the next section. **Technical details** All Anatsa droppers look similar code-wise. Upon the start of the app, a service is started to check if the “update” was installed. The dropper makes a request towards the C2 sending information about the device, including device ID, device name, locale, country, Android SDK version. ----- As mentioned previously, not every device will receive the “update”. At this point, the C2 backend decides whether to provide the Anatsa payload or not based on the device information. Depending on the C2 response, the dropper will decide whether or not to download Anatsa. Such approach allows actors to target devices from specific regions and easily switch focus to another area. This behavior is in line with Anatsa moving from region to region, constantly updating its list of targeted financial institutions. Moreover, filtering allows cybercriminals to prevent the dropper from downloading the “update” during the evaluation process when publishing the app on Google Play. Our analysts have identified Anatsa droppers that initially (in their first versions published on Google Play) had no malicious functionality but modified their behavior in later versions adding the dropping functionality and a wider set of permissions required ----- When all conditions are met and the payload is ready, the user will be prompted to download and install it. After successfully downloading the “update”, the user will be asked for the permission to install apps from unknown sources. The user, previously convinced that the update is necessary for the app to work properly, grants the permission. After the installation is complete, Anatsa is running on the device and immediately asks the victim to grant Accessibility Service privileges. ----- After enabling Accessibility Service, Anatsa has full control over the device and can perform actions on the victim’s behalf. At the same time, the dropper app is also running and operating as a legitimate app, the victim will probably remain unsuspecting. ## Hydra and Ermac campaign **Brunhilda : The return of the Valkyrie** ThreatFabric identified multiple instances of malware dropped by the Brunhilda threat actor group, and in line with previous campaigns, it constituted of trojanized apps. Brunhilda was observed dropping different malware families. In the first case, we observed Brunhilda posing as a QR code creator app, Brunhilda dropped samples from established families, like [Hydra, as well as novel ones, like Ermac.](https://www.threatfabric.com/blogs/bianlian_from_rags_to_riches_the_malware_dropper_that_had_a_dream.html) ----- The apps dropped by this Brunhilda campaign do not differ in functioning too much from the previous versions we have observed during 2021. As it did in the previous iterations, Brunhilda sends a registration request to its C2 using the gRPC protocol. Upon successful registration, and after communicating more detailed information about the device, the dropper is instructed by the C2 to download and install the payload package. Both families have been very active in the last months, even adventuring to markets that were previously untapped, like the United States. This new wave of malware, which started in August 2021, includes also other families like Gustuff and Anatsa. ----- ## Alien campaign As mentioned before, ThreatFabric observed Brunhilda serving different malware families. Some samples were observed having [more than 50.000+ installations, and dropping the android trojan Alien.](https://www.threatfabric.com/blogs/alien_the_story_of_cerberus_demise.html) [Also in this case, as it happened with the deployment of Vultur, these aps reached thousands of downloads before being taken down](https://www.threatfabric.com/blogs/vultur-v-for-vnc.html) from the store. The samples were very successful in their operation, with samples ranging from 5.000+ downloads to the impressive values of 50.000+ downloads. With these numbers in mind, it is fair to say that this dropper family was likely able to infect hundreds of thousands of victims during its operation. **Gymdrop : a Gym you do not want to visit** ----- In November 2021 ThreatFabric analysts discovered yet another dropper in Google Play. It had 10.000 installations and masquerades as an app for self-training. This dropper, that we dubbed “Gymdrop”, is another example of how cybercriminals try to convince victims and detection systems that their app is legitimate. The app website is designed to look legitimate at first glance. However, it is only a template for a gym website with no useful information on it, even still containing ‘Lorem Ipsum’ placeholder text in its pages. The developer website also serves as C2 for Gymdrop. Just like previously observed, this dropper tried to convince victims to install a fake update. However, in this case, it is done in a more inventive way: the payload is posed as a new package of workout exercises in conformity with the app. After the user clicks “OK”, the dropper will request the permissions needed. ----- Shortly after the dropper gets its configuration from the C2. The configuration file contains the link to download the payload. Moreover, the configuration contains filter rules based on device model. Based on the models being filtered out and the code of the dropper, we can draw a conclusion that this is done to avoid downloading the payload on emulators or research environment. If all conditions are met, the payload will be downloaded and installed. This dropper also does not request Accessibility Service privileges, it just requests permission to install packages, spiced with the promise to install new workout exercises - to entice the user to grant this permission. When installed, the payload is launched. Our threat intelligence shows that at the moment this dropper is used to distribute Alien banking trojan. ----- While writing this blog post, Gymdrop was updated (a new version was uploaded to Google Play). However, the configuration file was not found on C2. It could probably be done to not serve the payload to pass security checks performed by Google before publishing the update on Google Play. **2 dropper APPS to boost botnet-building** It is worth mentioning that the Alien samples of this campaign connect to the same C2 as samples from previously described campaign powered by Brunhilda dropper. This leads us to the conclusion that the actor(s) behind these Alien campaigns use at least 2 different dropper services in their distribution strategy. ----- ## Conclusion In the span of only 4 months, 4 large Android families were spread via Google Play, resulting in 300.000+ infections via multiple dropper apps. A noticeable trend in the new dropper campaigns is that actors are focusing on loaders with a reduced malicious footprint in Google Play, considerably increasing the difficulties in detecting them with automation and machine learning techniques. The small malicious footprint is a result of the new Google Play restrictions (current and planned) to put limitations on the use of privacy concerning app permissions. Permissions such as Accessibility Service, which in previous campaigns was one of the core tactics abused to automate the installation process of Android banking trojans via dropper apps in Google Play. By limiting the use of these permissions, actors were forced to choose the more conventional way of installing apps, which is by asking the installation permission, with the side-effect of blending in more with legitimate apps. This is one of the core reasons of the significant success of mobile banking threat actors in sneaking into Google’s trusted app store. A second big factor behind their success is that actors have set restrictions, with mechanisms to ensure that the payload is installed only on the victim’s device and not on testing environments. To achieve this, criminals use a multitude of techniques, which range from location checks to incremental malicious updates, passing by time-based de-obfuscation and server-side emulation checks. This incredible attention dedicated to evading unwanted attention renders automated malware detection less reliable. This consideration is confirmed by the very low overall VirusTotal score of the 9 number of droppers we have investigated in this blogpost. ## How we help our customers ThreatFabric makes it easier than it has ever been to run a secure mobile payments business. With the most advanced threat intelligence for mobile banking, financial institutions can build a risk-based mobile security strategy and use this unique knowledge to detect fraud-by-malware on the mobile devices of customers in real-time. Together with our customers and partners, we are building an easy-to-access information system to tackle the ever-growing threat of mobile malware targeting the financial sector. We especially like to thank the Cyber Defence Alliance (CDA) for collaborating and proactively sharing knowledge and information across the financial sector to fight cyber-threats. ThreatFabric has partnerships with TIPs all over the world. If you want to request a free trial of our MTI-feed, or want to test our own MTI portal for 30 days, feel free to contact us at: [sales@threatfabric.com](http://10.10.0.46/mailto://sales@threatfabric.com) ----- If you want more information on how we detect mobile malware on mobile devices, you can directly contact us at: [info@threatfabric.com](http://10.10.0.46/mailto://info@threatfabric.com) ## Appendix: IOC ### Brunhilda Dropper Samples **App name** **Package name** **SHA-256** Two Factor Authenticator com.flowdivison a3bd136f14cc38d6647020b2632bc35f21fc643c0d3741caaf92f48df0fc6997 Protection Guard com.protectionguard.app d3dc4e22611ed20d700b6dd292ffddbc595c42453f18879f2ae4693a4d4d925a QR CreatorScanner Master Scanner Live com.ready.qrscanner.mix ed537f8686824595cb3ae45f0e659437b3ae96c0a04203482d80a3e51dd915ab com.multifuction.combine.qr 7aa60296b771bdf6f2b52ad62ffd2176dc66cb38b4e6d2b658496a6754650ad4 ### Brunhilda Dropper C2 URL **URL** hxxps://protectionguardapp[.]club hxxps://readyqrscanner[.]club hxxps://flowdivison[.]club hxxps://multifuctionscanner[.]club ### Anatsa Dropper Samples **App name** **Package name** **SHA-256** QR Scanner 2021 com.qr.code.generate 2db34aa26b1ca5b3619a0cf26d166ae9e85a98babf1bc41f784389ccc6f54afb QR Scanner com.qr.barqr.scangen d4e9a95719e4b4748dba1338fdc5e4c7622b029bbcd9aac8a1caec30b5508db4 PDF Document Scanner Scan to PDF PDF Document Scanner PDF Document Scanner Free com.xaviermuches.docscannerpro2 2080061fe7f219fa0ed6e4c765a12a5bc2075d18482fa8cf27f7a090deca54c5 com.docscanverifier.mobile 974eb933d687a9dd3539b97821a6a777a8e5b4d65e1f32092d5ae30991d4b544 com.doscanner.mobile 16c3123574523a3f1fb24bbe6748e957afff21bef0e05cdb3b3e601a753b8f9d CryptoTracker cryptolistapp.app.com.cryptotracker 1aafe8407e52dc4a27ea800577d0eae3d389cb61af54e0d69b89639115d5273c ### Anatsa Dropper C2 URL **URL** hxxp://195.201.70.88/api/update hxxp://178.63.27.179/api/update hxxp://91.242.229.85/api/update hxxp://195.201.70.89/api/update ----- ### Gymdrop Dropper Samples **App name** **Package name** **SHA-256** Gym and Fitness Trainer com.gym.trainer.jeux 30ee6f4ea71958c2b8d3c98a73408979f8179159acccc01b6fd53ccb20579b6b Gym and Fitness Trainer com.gym.trainer.jeux b3c408eafe73cad0bb989135169a8314aae656357501683678eff9be9bcc618f ### Gymdrop Dropper C2 URL **URL** hxxps://onlinefitnessanalysis[.]com/ ### Malware Samples dropped **Malware** **Family** **App name** **Package name** **SHA-256** Alien.A Master Scanner Live Alien.A Gym and Fitness Trainer Anatsa.A PDF AI : TEXT RECOGNIZER Hydra.C QR CreatorScanner Ermac.A QR CreatorScanner leaf.leave.exchang 74407e40e1c01e73087442bcdf3a0802121c4263ab67122674d9d09b3edf856e gesture.enlist.say e8cbcc34af3bd352767b7a9270dd684a50da2e68976a3712675526a7398550a0 com.uykxx.noazg d42e0d3db3662e809af3198da67fdbd46d5c2a1052b5945401e4cdd06c197714 com.cinnamon.equal 9ab66c1b7db44abaa53850a3d6a9af36c8ad603dab6900caba592497f632349f com.tag.right fd7e7e23db5f645db9ed47a5d36e7cf57ca2dbdf46a37484eafa1e04f657bf02 ## Appendix: Targeted apps ### Alien.A Targets **Package Name** **App Name** com.kubi.kucoin KuCoin: Bitcoin Exchange & Crypto Wallet com.abanca.bm.pt ABANCA - Portugal com.bitfinex.mobileapp Bitfinex com.changelly.app Changelly: Buy Bitcoin BTC & Fast Crypto Exchange es.liberbank.cajasturapp Banca Digital Liberbank wit.android.bcpBankingApp.millennium Millenniumbcp es.openbank.mobile Openbank – banca móvil pt.bctt.appbctt Banco CTT com.exictos.mbanka.bic Banco BIC, SA com.kraken.trade Pro: Advanced Bitcoin & Crypto Trading com.plunien.poloniex Poloniex Crypto Exchange com.kutxabank.android Kutxabank com.bitpay.wallet BitPay – Secure Bitcoin Wallet com.binance.dev Binance - Buy & Sell Bitcoin Securely ----- **Package Name** **App Name** com.bbva.netcash BBVA Net Cash ES & PT com.coinbase.android Coinbase – Buy & Sell Bitcoin. Crypto Wallet com.rsi.Colonya Colonya Caixa Pollença com.transferwise.android TransferWise Money Transfer pt.bancobpi.mobile.fiabilizacao BPI APP com.bancamarch.bancamovil Banca March com.mycelium.wallet Mycelium Bitcoin Wallet com.cajasur.android Cajasur com.tecnocom.cajalaboral Banca Móvil Laboral Kutxa net.bitbay.bitcoin Bitcoin & Crypto Exchange - BitBay es.evobanco.bancamovil EVO Banco móvil com.bankinter.portugal.bmb Bankinter Portugal com.google.android.gm Gmail pt.bancobest.android.mobilebanking Best Bank com.wavesplatform.wallet Waves.Exchange net.bitstamp.app Bitstamp – Buy & Sell Bitcoin at Crypto Exchange es.bancosantander.apps Santander com.microsoft.office.outlook Microsoft Outlook: Organize Your Email & Calendar com.okinc.okex.gp OKEx - Bitcoin/Crypto Trading Platform com.grupocajamar.wefferent Grupo Cajamar com.bankinter.launcher Bankinter Móvil es.cm.android Bankia pt.novobanco.nbapp NB smart app com.cajaingenieros.android.bancamovil Caja de Ingenieros Banca MÓVIL es.ibercaja.ibercajaapp Ibercaja pt.santandertotta.mobileempresas Santander Empresas es.pibank.customers Pibank piuk.blockchain.android Blockchain Wallet. Bitcoin, Bitcoin Cash, Ethereum com.indra.itecban.mobile.novobanco NBapp Spain com.mediolanum Banco Mediolanum España com.android.vending Google Play com.bbva.mobile.pt BBVA Portugal com.squareup.cash Cash App es.caixagalicia.activamovil ABANCA- Banca Móvil es.univia.unicajamovil UnicajaMovil org.electrum.electrum Electrum Bitcoin Wallet ----- **Package Name** **App Name** app.wizink.es WiZink, tu banco senZillo com.yahoo.mobile.client.android.mail Yahoo Mail – Organized Email cgd.pt.caixadirectaparticulares Caixadirecta com.connectivityapps.hotmail Connect for Hotmail & Outlook: Mail and Calendar com.mail.mobile.android.mail mail.com mail com.imaginbank.app imaginBank - Your mobile bank es.caixaontinyent.caixaontinyentapp Caixa Ontinyent www.ingdirect.nativeframe ING España. Banca Móvil eu.atlantico.bancoatlanticoapp MY ATLANTICO com.bbva.bbvacontigo BBVA Spain com.citi.mobile.ccc CitiManager – Corporate Cards ca.mobile.explorer CA Mobile com.paypal.android.p2pmobile PayPal Mobile Cash: Send and Request Money Fast com.rsi ruralvía es.cecabank.ealia2103appstore UniPay Unicaja wit.android.bcpBankingApp.activoBank ActivoBank com.indra.itecban.triodosbank.mobile.banki es.lacaixa.mobile.android.newwapicon CaixaBank com.db.pbc.mibanco Mi Banco db com.targoes_prod.bad TARGOBANK - Banca a distancia ### Ermac.A Targets **Package Name** **App Name** eu.inmite.prj.kb.mobilbank Mobilni Banka com.greater.Greater Greater Bank uk.co.tsb.newmobilebank TSB Mobile Banking org.microemu.android.model.common.VTUserApplicationLINKMB Link Celular es.lacaixa.mobile.android.newwapicon CaixaBank com.IngDirectAndroid ING France es.bancosantander.apps Santander com.ocito.cdn.activity.creditdunord Crédit du Nord pour Mobile pl.ideabank.mobilebanking Idea Bank PL gt.com.bi.bienlinea Bi en Línea org.banking.bsa.businessconnect BankSA Business App pl.envelobank.aplikacja EnveloBank net.inverline.bancosabadell.officelocator.android Banco Sabadell App. Your mobile bank com.msf.kbank.mobile Kotak - 811 & Mobile Banking ----- **Package Name** **App Name** au.com.ingdirect.android ING Australia Banking com.getingroup.mobilebanking Getin Mobile au.com.amp.myportfolio.android My AMP com.magiclick.odeabank Odeabank com.mtel.androidbea BEA 東亞銀行 eu.eleader.mobilebanking.pekao.firm PekaoBiznes24 org.banking.stg.businessconnect St.George Business App softax.pekao.powerpay PeoPay com.rsi ruralvía my.com.hsbc.hsbcmalaysia HSBC Malaysia com.td TD Canada org.banksa.bank BankSA Mobile Banking org.bom.bank Bank of Melbourne Mobile Banking com.zoluxiones.officebanking Banco Santander Perú S.A. com.pcfinancial.mobile Simplii Financial es.evobanco.bancamovil EVO Banco móvil com.latuabancaperandroid Intesa Sanpaolo Mobile com.fusion.beyondbank Beyond Bank Australia com.rbs.mobile.android.rbs Royal Bank of Scotland Mobile Banking com.unicredit Mobile Banking UniCredit com.tarjetanaranja.emisor.serviciosClientes.appTitulares Naranja au.com.newcastlepermanent NPBS Mobile Banking au.com.suncorp.SuncorpBank Suncorp Bank de.traktorpool tractorpool hu.cardinal.erste.mobilapp Erste Business MobilBank au.com.bankwest.mobile Bankwest it.popso.SCRIGNOapp SCRIGNOapp de.dkb.portalapp DKB-Banking pe.com.interbank.mobilebanking Interbank APP it.copergmps.rt.pf.android.sp.bmps Banca MPS de.consorsbank Consorsbank com.isis_papyrus.raiffeisen_pay_eyewdg Raiffeisen ELBA de.fiducia.smartphone.android.banking.vr VR Banking Classic com.pozitron.iscep İşCep - Mobile Banking wit.android.bcpBankingApp.millenniumPL Bank Millennium es.ibercaja.ibercajaapp Ibercaja ----- **Package Name** **App Name** alior.bankingapp.android Usługi Bankowe com.krungsri.kma KMA it.ingdirect.app ING Italia com.mobillium.papara Papara de.adesso_mobile.secureapp.netbank SecureApp netbank com.nearform.ptsb permanent tsb com.konylabs.cbplpat Citi Handlowy com.lynxspa.bancopopolare YouApp tr.com.sekerbilisim.mbank ŞEKER MOBİL ŞUBE com.appfactory.tmb Teachers Mutual Bank au.com.mebank.banking ME Bank com.kasikorn.retail.mbanking.wap K PLUS com.infrasofttech.MahaBank Maha Mobile com.pttfinans PTTBank es.univia.unicajamovil UnicajaMovil au.com.commbank.commbiz.prod CommBiz my.com.maybank2u.m2umobile Maybank2u MY es.pibank.customers Pibank de.ingdiba.bankingapp ING Banking to go com.fusion.banking Bank Australia app com.tecnocom.cajalaboral Banca Móvil Laboral Kutxa pegasus.project.ebh.mobile.android.bundle.mobilebank George Magyarország au.com.rams.RAMS myRAMS com.teb CEPTETEB eu.netinfo.colpatria.system Scotiabank Colpatria de.santander.presentation Santander Banking es.openbank.mobile Openbank – banca móvil pl.raiffeisen.nfc Mobilny Portfel pt.novobanco.nbapp NB smart app uk.co.metrobankonline.mobile.android.production Metro Bank com.tmobtech.halkbank Halkbank Mobil de.mobile.android.app mobile.de – Germany‘s largest car market net.bnpparibas.mescomptes Mes Comptes BNP Paribas com.mercadolibre Mercado Libre: compra fácil y rápido uk.co.mbna.cardservices.android MBNA - Card Services App hu.cardinal.cib.mobilapp CIB Business Online ----- **Package Name** **App Name** fr.creditagricole.androidapp Ma Banque jp.co.rakuten_bank.rakutenbank 楽天銀行 -個人のお客様向けアプリ org.banking.bom.businessconnect Bank of Melbourne Business App pl.ing.mojeing Moje ING mobile pl.pkobp.ipkobiznes iPKO biznes com.usbank.mobilebanking U.S. Bank - Inspired by customers pl.pkobp.iko IKO com.anz.transactive.global ANZ Transactive - Global com.bankofqueensland.boq BOQ Mobile com.ingbanktr.ingmobil ING Mobil com.tdbank TD Bank (US) com.scb.phone SCB EASY com.Version1 PNB ONE net.garagecoders.e_llavescotiainfo ScotiaMóvil nz.co.asb.asbmobile ASB Mobile Banking com.finanteq.finance.bgz BNP Paribas GOMobile com.woodforest Woodforest Mobile Banking ro.btrl.mobile Banca Transilvania uk.co.hsbc.hsbcukmobilebanking HSBC UK Mobile Banking com.todo1.mobile Bancolombia App Personas com.uy.itau.appitauuypf Itaú Uruguay com.key.android KeyBank Mobile it.bnl.apps.banking BNL au.com.cua.mb CUA Mobile Banking com.ykb.android Yapı Kredi Mobile ktbcs.netbank Krungthai NEXT com.santander.bpi Santander Private Banking posteitaliane.posteapp.apppostepay Postepay uk.co.tescomobile.android Tesco Mobile es.ceca.cajalnet Cajalnet com.scotiabank.banking Scotiabank Mobile Banking it.nogood.container UBI Banca pl.noblebank.mobile Noble Mobile com.suntrust.mobilebanking SunTrust Mobile App pl.eurobank2 eurobank mobile 2.0 com.mobileloft.alpha.droid myAlpha Mobile ----- **Package Name** **App Name** com.unionbank.ecommerce.mobile.android Union Bank Mobile Banking pl.millennium.corpApp Bank Millennium for Companies au.com.hsbc.hsbcaustralia HSBC Australia com.starfinanz.smob.android.sfinanzstatus Sparkasse Ihre mobile Filiale org.westpac.col Westpac Corporate Mobile au.com.macquarie.banking Macquarie Mobile Banking finansbank.enpara Enpara.com Cep Şubesi org.stgeorge.bank St.George Mobile Banking com.mcom.firstcitizens First Citizens Mobile Banking fr.laposte.lapostemobile La Poste - Services Postaux es.bancosantander.empresas Santander Empresas fr.lcl.android.customerarea Mes Comptes - LCL fr.banquepopulaire.cyberplus Banque Populaire uk.co.santander.santanderUK Santander Mobile Banking com.comarch.mobile.banking.bgzbnpparibas.biznes Mobile BiznesPl@net pl.fakturownia Fakturownia.pl pt.bancobpi.mobile.fiabilizacao BPI APP de.commerzbanking.mobil Commerzbank Banking - The app at your side de.comdirect.android comdirect mobile App com.kutxabank.android Kutxabank pt.santandertotta.mobileparticulares Santander Particulares es.caixageral.caixageralapp Banco Caixa Geral España com.itau.empresas Itaú Empresas: Controle e Gestão do seu Negócio wit.android.bcpBankingApp.millennium Millenniumbcp com.sbi.SBIFreedomPlus Yono Lite SBI - Mobile Banking fr.oney.mobile.mescomptes Oney France pl.bzwbk.bzwbk24 Santander mobile com.vancity.mobileapp Vancity com.comarch.security.mobilebanking ING Business com.snapwork.hdfc HDFC Bank MobileBanking es.caixagalicia.activamovil ABANCA- Banca Móvil tsb.mobilebanking TSB Bank Mobile Banking com.zellepay.zelle Zelle ma.gbp.pocketbank Pocket Bank de.postbank.finanzassistent Postbank Finanzassistent com.bendigobank.mobile Bendigo Bank ----- **Package Name** **App Name** es.liberbank.cajasturapp Banca Digital Liberbank hu.bb.mobilapp Budapest Bank Mobil App com.pnc.ecommerce.mobile PNC Mobile eu.atlantico.bancoatlanticoapp MY ATLANTICO pl.bps.bankowoscmobilna BPS Mobilnie eu.unicreditgroup.hvbapptan HVB Mobile Banking com.konylabs.HongLeongConnect Hong Leong Connect Mobile Banking pl.aliorbank.aib Alior Mobile com.mfoundry.mb.android.mb_136 People’s United Bank Mobile au.com.ubank.internetbanking UBank Mobile Banking de.number26.android N26 — The Mobile Bank cz.csob.smartbanking ČSOB Smartbanking mobi.societegenerale.mobile.lappli L’Appli Société Générale com.vakifbank.mobile VakıfBank Mobil Bankacılık com.anz.android.gomoney ANZ Australia mbanking.NBG NBG Mobile Banking pl.bph BusinessPro Lite com.finanteq.finance.ca CA24 Mobile com.quoine.quoinex.light Liquid by Quoineライト版（リキッドバイコイン） -ビットコ インなどの仮想通貨取引所 enterprise.com.anz.shield ANZ Shield pl.bzwbk.ibiznes24 iBiznes24 mobile tr.com.hsbc.hsbcturkey HSBC Turkey com.kuveytturk.mobil Kuveyt Türk com.ziraat.ziraatmobil Ziraat Mobile com.targo_prod.bad TARGOBANK Mobile Banking au.com.nab.mobile NAB Mobile Banking com.samba.mb SambaMobile org.westpac.bank Westpac Mobile Banking pl.ifirma.ifirmafaktury IFIRMA - Darmowy Program do Faktur com.rbc.mobile.android RBC Mobile com.tideplatform.banking Tide - Smart Mobile Banking com.sbi.SBAnywhereCorporate SBI Anywhere Corporate hu.mkb.mobilapp MKB Mobilalkalmazás com.todo1.davivienda.mobileapp Davivienda Móvil jp.co.netbk 住信SBIネット銀行 com.navyfederal.android Navy Federal Credit Union ----- **Package Name** **App Name** com.infrasofttech.CentralBank Cent Mobile com.konylabs.capitalone Capital One® Mobile es.cm.android Bankia pl.mbank mBank PL com.wf.wellsfargomobile Wells Fargo Mobile gr.winbank.mobilenext Winbank Mobile com.westernunion.moneytransferr3app.es Western Union ES - Send Money Transfers Quickly com.snapwork.IDBI IDBI Bank GO Mobile+ com.commbank.netbank CommBank mx.bancosantander.supermovil Santander móvil com.rbs.mobile.android.natwest NatWest Mobile Banking it.carige Carige Mobile com.usaa.mobile.android.usaa USAA Mobile eu.eleader.mobilebanking.pekao Pekao24Makler ### Anatsa.A Targets **Package Name** **App Name** uk.co.hsbc.hsbcukmobilebanking HSBC UK Mobile Banking com.chase.sig.android Chase Mobile com.wf.wellsfargomobile Wells Fargo Mobile com.citi.citimobile Citi Mobile® com.konylabs.capitalone Capital One® Mobile com.infonow.bofa Bank of America Mobile Banking com.jpm.sig.android J.P. Morgan Mobile com.usbank.mobilebanking U.S. Bank - Inspired by customers com.truist.mobile Truist Mobile - Banking Made Better com.pnc.ecommerce.mobile PNC Mobile com.tdbank TD Bank (US) com.schwab.mobile Schwab Mobile com.statestreetbank.grip State Street Bank us.hsbc.hsbcus HSBC US com.citizensbank.androidapp Citizens Bank Mobile Banking com.syf.synchronybank Synchrony Bank com.creditonebank.mobile Credit One Bank Mobile com.monitise.client.android.clydesdale Clydesdale Bank Mobile Banking com.fidelity.android Fidelity Investments us.current.android Earn Cash Reward: Make Money Playing Games & Music ----- **Package Name** **App Name** com.robinhood.android Robinhood - Investment & Trading, Commission-free com.moneylion MoneyLion: Mobile Banking App com.sablemoney.sableapp.prod Sable com.virginmoney.uk.mobile.android Virgin Money Mobile Banking com.monitise.client.android.yorkshire Yorkshire Bank Mobile Banking com.monitise.client.android.clydesdale Clydesdale Bank Mobile Banking com.algorand.android Algorand Wallet com.coinbase.android Coinbase – Buy & Sell Bitcoin. Crypto Wallet co.mona.android Crypto.com - Buy Bitcoin Now com.monese.monese.live Monese - Mobile Money Account for UK & Europe com.binance.dev Binance - Buy & Sell Bitcoin Securely com.danskebank.mobilebank3.uk Mobile Bank UK – Danske Bank com.rbs.mobile.android.ubn Ulster Bank NI Mobile Banking com.rbs.mobile.android.natwest NatWest Mobile Banking com.rbs.mobile.android.natwestoffshore NatWest International com.plunien.poloniex Poloniex Crypto Exchange com.wallet.crypto.trustapp Trust: Crypto & Bitcoin Wallet com.cooperativebank.bank The Co-operative Bank uk.co.metrobankonline.mobile.android.production Metro Bank com.starlingbank.android Starling Bank - Better Mobile Banking io.metamask MetaMask - Buy, Send and Swap Crypto co.uk.getmondo Monzo Bank com.binance.us Binance.US com.kraken.invest.app Kraken - Buy Bitcoin & Crypto com.blockfolio.blockfolio Blockfolio - Bitcoin and Cryptocurrency Tracker com.gemini.android.app Gemini: Buy Bitcoin Instantly com.okinc.okcoin.intl Okcoin - Buy & Trade Bitcoin, Ethereum, & Crypto com.barclays.android.barclaysmobilebanking Barclays com.tideplatform.banking Tide - Smart Mobile Banking com.grppl.android.shell.halifax Halifax: the banking app that gives you extra com.grppl.android.shell.CMBlloydsTSB73 Lloyds Bank Mobile Banking: by your side com.usaa.mobile.android.usaa USAA Mobile com.blockfi.mobile BlockFi - Buy, Earn, Borrow Crypto com.marcus.android Marcus by Goldman Sachs® com.unionbank.ecommerce.mobile.android Union Bank Mobile Banking org.penfed.mobile.banking PenFed ----- **Package Name** **App Name** com.navyfederal.android Navy Federal Credit Union com.stash.stashinvest Stash: Invest, Bank, Save com.regions.mobbanking Regions Bank com.varomoney.bank Varo Bank: Mobile Banking com.current.app Current - Modern Banking com.huntington.m Huntington Mobile com.clairmail.fth Fifth Third Mobile Banking com.mint Mint: Personal Finance Manager piuk.blockchain.android Blockchain Wallet. Bitcoin, Bitcoin Cash, Ethereum com.q2e.texasdowcreditunion5004401st.mobile.production TDECU Digital Banking pr.com.firstbank FirstBank Digital Banking App com.oneazcu.banking OneAZ Mobile Banking com.axos.udb Axos Bank® com.etrade.mobilepro.activity E*TRADE: Invest. Trade. Save. org.suncoast.mobile Suncoast SunMobile com.firsttech.firsttech First Tech Federal CU org.ncsecu.mobile SECU org.ncsecu.mobile SECU com.softek.ofxclmobile.warrenfcu Blue FCU Mobile Banking App com.bethpage.bethpage Bethpage Mobile Banking com.myoccu.mobile MyOCCU Mobile Banking com.ifs.banking.fiid3160 Tru2Go Truliant Mobile Banking com.desertschools.mobilebanking Desert Financial Mobile com.nymfcu.nymfcu NYMCU Mobile Banking com.softek.ofxclmobile.summitcu Summit Credit Union Mobile com.fi7453.godough PFFCU Mobile Banking com.cuamerica.cuamerica Credit Union of America com.ifs.banking.fiid3337 Arizona Federal Mobile Banking com.ksfcu.ksfcu Valley Strong DataMobile com.ifs.mobilebanking.fiid9094 Service CU Mobile Banking com.scottcreditunion5029.mobile Scott Credit Union com.socalcu.socalcu CU SoCal Mobile Banking com.q2e.unitedfcu5017android.ufcu.uwnmobile United Federal Credit Union com.credituniononecu.credituniononecu NEW - Credit Union One Michigan mobile.dcfcu.org DCFCU Mobile com.ifs.mobilebanking.fiid3919 Associated Credit Union Mobile ----- **Package Name** **App Name** com.ifs.banking.fiid1359 WPCU Mobile Banking com.growfinancialfcu.growfinancialfcu Grow Mobile Banking com.nexowallet Nexo - Crypto Banking Account com.investvoyager Voyager: Crypto Made Simple com.mobileloft.alpha.droid myAlpha Mobile mbanking.NBG NBG Mobile Banking com.vivawallet.business Viva Wallet gr.winbank.mobilenext Winbank Mobile com.EurobankEFG Eurobank Mobile App io.sperax.wallet Sperax Play ru.sberbankmobile Сбербанк Онлайн ru.otpbank.mobile ОТП Банк ru.letobank.Prometheus Почта Банк ge.lb.mobilebank Liberty com.idamob.tinkoff.android Tinkoff ru.bankuralsib.mb.android Мобильный банк УРАЛСИБ gr.nbg.go4more go4more com.ubanksu UBANK ru.vtb24.mobilebanking.android VTB-Online com.mtbank Мой банк com.columbiabank3685.mobile.production Columbia Bank com.capital.etf.trade Investments - Capital.com ch.raiffeisen.twint Raiffeisen TWINT ch.postfinance.twint.android PostFinance TWINT com.csg.creditsuisse.twint Credit Suisse TWINT – mobile payment app ch.postfinance.android PostFinance Mobile com.csg.cs.dnmb Credit Suisse Direct com.ubs.swidK2Y.android UBS Access – secure login for digital banking com.ubs.swidKXJ.android UBS Mobile Banking: E-Banking and mobile pay com.neonbanking.app neon - your account app ch.raiffeisen.android Raiffeisen E-Banking com.flowbank.client FlowBank ch.bankcler.zak Bank Cler Zak com.axa.android.smartclaims.ch MyAXA CH ch.zkb.slv.mobile.client.android eBanking Mobile com.swissborg.android SwissBorg: Invest in Crypto ----- **Package Name** **App Name** ch.zkb.twint ZKB TWINT ch.zkb.frankly frankly. Pillar 3a – Private pension ch.bcv.mobile.android BCV Mobile at.rsg.pfp Mein ELBA-App at.erstebank.george George Österreich at.erstebank.securityapp s Identity com.bawagpsk.bawagpsk BAWAG PSK klar – Mobile Banking App com.bankaustria.android.olb Bank Austria MobileBanking at.tmobile.android.myt Mein Magenta (AT) com.bitpanda.bitpanda Bitpanda - Buy Bitcoin in minutes at.volksbank.volksbankmobile Volksbank hausbanking at.ing.diba.client.onlinebanking ING Banking Austria com.easybank.easybank easybank App at.oberbank.mbanking Oberbank de.xcom.flatexat flatex AT com.cardcomplete.completecontrol complete Control at.bank99.meine.meine meine99 Online Banking at.bks.mbanking BKS Bank Österreich at.racon.mandantvkb VKB CONNECT com.csiweb.digitalbanking.bk0617 Viking Bank Mobile com.csiweb.digitalbanking.bk0710 Minnesota National Bank dk.bec.android.mb1.b00369.prod Spar Nord Mobilbank dk.bec.android.mb1.b00020.prod AL-Bank dk.jyskebank.drb Jyske Bank dk.landbobanken.drb Ringkjøbing Landbobank og Nordjyske Bank dk.bec.android.mb1.b00019.prod Vestjysk Bank dk.nordea.mobilebank Nordea Mobile - Denmark dk.sydbank.drb Sydbanks Mobilbank Privat com.resurs.rbapp Resurs Bank com.danskebank.mobilebank3.dk NY mobilbank DK - Danske Bank nz.co.cooperativebank The Co-operative Bank (NZ) nz.co.anz.android.mobilebanking ANZ goMoney New Zealand nz.co.asb.asbmobile ASB Mobile Banking nz.co.asb.asbmobile ASB Mobile Banking nz.co.kiwibank.mobile Kiwibank Mobile Banking nz.co.westpac Westpac One (NZ) Mobile Banking ----- **Package Name** **App Name** com.commbank.netbank CommBank au.com.nab.mobile NAB Mobile Banking com.anz.android.gomoney ANZ Australia org.westpac.bank Westpac Mobile Banking com.bendigobank.mobile Bendigo Bank au.com.ingdirect.android ING Australia Banking org.stgeorge.bank St.George Mobile Banking au.com.bankwest.mobile Bankwest com.coinspot.app CoinSpot - Buy & Sell Bitcoin org.banksa.bank BankSA Mobile Banking au.com.heritage.app Heritage Mobile Banking org.bom.bank Bank of Melbourne Mobile Banking au.com.cua.mb CUA Mobile Banking au.com.swyftx Swyftx Cryptocurrency Exchange - Buy, Sell & Trade com.citibank.mobile.au Citibank Australia au.com.mebank.banking ME Bank au.com.newcastlepermanent NPBS Mobile Banking com.fusion.beyondbank Beyond Bank Australia com.bankofqueensland.boq BOQ Mobile com.adcb.cbgdigi ADCB Hayyak: Start your banking relationship now! com.cbd.mobile CBD com.dib.app DIB MOBILE com.mashreq.NeoApp Mashreq Neo - Bank easy com.adcb.bank ADCB enbd.mobilebanking Emirates NBD com.fab.personalbanking FAB Mobile com.adib.mobile ADIB Mobile Banking App com.rak RAKBANK Digital Banking com.adib.smartmoney smartbanking by ADIB com.alhilal.hayyak Ahlan by Al Hilal Bank com.kubi.kucoin KuCoin: Bitcoin Exchange & Crypto Wallet com.mbc.anb.keystore ANB Mobile~ Arab National Bank com.phonepe.app PhonePe: UPI, Recharge, Investment, Insurance com.rainmanagement.rain Rain: Buy & Sell Bitcoin com.BanqueMisr.MobileBanking BM Online com.riyadbank.strategic RiyadBank Mobile ----- **Package Name** **App Name** sa.liv.android Liv. KSA - Digital Banking com.alahli.mobile.android SNB AlAhli Mobile com.alrajhiretailapp Al Rajhi Mobile com.samba.mb SambaMobile com.sabb.mobilebanking SABBMobile com.bsffm FransiMobile com.alinma.retail.mobile Alinma Bank com.saib.banking.mobile.android SAIB com.slsp.mtoken SLSP mToken sk.slsp.georgego George Go Slovensko bank.sk365.app 365.bank sk.tb.ib.tatraandroid Tatra banka sk.csob.smarttoken CSOB SmartToken com.zentity.sbank.csobsk SmartBanking sk.vub.mobile VÚB Mobile Banking sk.tb.emv.mobile Čítačka sk.raiffeisen.ib.androidwrapper Raiffeisen Bank SK cz.homecredit.hcsk Home Credit SK com.zentity.pabk Poštová banka hr.asseco.android.jimba.mUCI.sk SmartBanking SK sk.mbank mBank SK sk.primabanka.penazenka Peňaženka com.firstdirect.bankingonthego first direct com.revolut.revolut Revolut - Get more from your money com.outsystemsenterprise.thinkmoneyprod.ThinkMoney thinkmoney com.vanso.gtbankapp GTBank com.suntrust.mobilebanking SunTrust Mobile App ### Hydra.C Targets **Package Name** **App Name** com.netflix.mediaclient Netflix eu.inmite.prj.kb.mobilbank Mobilni Banka com.bitfinex.mobileapp Bitfinex com.google.android.gm Gmail es.lacaixa.mobile.android.newwapicon CaixaBank co.com.bbva.mb BBVA Colombia com.albarakaapp Albaraka Mobile Banking ----- **Package Name** **App Name** com.indra.itecban.triodosbank.mobile.banki es.bancosantander.apps Santander pl.ideabank.mobilebanking Idea Bank PL pl.envelobank.aplikacja EnveloBank net.inverline.bancosabadell.officelocator.android Banco Sabadell App. Your mobile bank com.ambank.ambankonline AmOnline com.liberty.jaxx Jaxx Liberty: Blockchain Wallet com.yahoo.mobile.client.android.mail Yahoo Mail – Organized Email pl.int.poczta INT Poczta com.bitcoin.mwallet Bitcoin Wallet com.cleverlance.csas.servis24 SERVIS 24 Mobilni banka com.getingroup.mobilebanking Getin Mobile org.electrum.electrum Electrum Bitcoin Wallet com.magiclick.odeabank Odeabank com.akbank.android.apps.akbank_direkt Akbank cz.rb.app.smartphonebanking Mobilní eKonto Raiffeisenbank com.db.pwcc.dbmobile Deutsche Bank Mobile com.avuscapital.trading212 Trading 212 - Stocks, ETFs, Forex, Gold softax.pekao.powerpay PeoPay com.binance.dev Binance - Buy & Sell Bitcoin Securely com.rsi ruralvía com.connectivityapps.hotmail Connect for Hotmail & Outlook: Mail and Calendar huawei.settings.pin com.denizbank.mobildeniz MobilDeniz com.grupoavalav1.bancamovil AV Villas App my.com.hsbc.hsbcmalaysia HSBC Malaysia eu.eleader.mobilebanking.pekao Pekao24Makler com.bcp.bank.bcp Banca Móvil BCP com.zoluxiones.officebanking Banco Santander Perú S.A. com.indra.itecban.mobile.novobanco NBapp Spain es.evobanco.bancamovil EVO Banco móvil com.rbs.mobile.android.rbs Royal Bank of Scotland Mobile Banking samsung.settings.pin com.grupocajamar.wefferent Grupo Cajamar com.samsung.android.email.provider Samsung Email com.clairmail.fth Fifth Third Mobile Banking ----- **Package Name** **App Name** com.hittechsexpertlimited.hitbtc HitBTC – Bitcoin Trading and Crypto Exchange de.dkb.portalapp DKB-Banking io.totalcoin.wallet Bitcoin Wallet Totalcoin - Buy and Sell Bitcoin pe.com.interbank.mobilebanking Interbank APP cz.fio.sb2 Fio Smartbanking CZ es.caixaontinyent.caixaontinyentapp Caixa Ontinyent de.fiducia.smartphone.android.banking.vr VR Banking Classic com.polehin.android Bitcoin Wallet - Buy BTC com.pozitron.iscep İşCep - Mobile Banking com.cajaingenieros.android.bancamovil Caja de Ingenieros Banca MÓVIL wit.android.bcpBankingApp.millenniumPL Bank Millennium es.ibercaja.ibercajaapp Ibercaja alior.bankingapp.android Usługi Bankowe pl.interia.poczta_next Nowa Poczta Interia com.mobillium.papara Papara com.uphold.wallet Uphold - Trade, Invest, Send Money For Zero Fees pl.cinkciarz Currency Exchange Conotoxia com.nearform.ptsb permanent tsb com.db.mm.norisbank norisbank App com.konylabs.cbplpat Citi Handlowy tr.com.sekerbilisim.mbank ŞEKER MOBİL ŞUBE cz.csob.smartbanking.era Smartbanking PS com.citi.citimobile Citi Mobile® pl.onet.mail Onet Poczta - e-mail app com.cooperativebank.bank The Co-operative Bank cz.equabank.mobilebanking Equa bank com.pttfinans PTTBank es.univia.unicajamovil UnicajaMovil com.garanti.cepsubesi Garanti BBVA Mobile my.com.maybank2u.m2umobile Maybank2u MY cz.seznam.email Email.cz es.pibank.customers Pibank com.coinbase.android Coinbase – Buy & Sell Bitcoin. Crypto Wallet de.ingdiba.bankingapp ING Banking to go com.bancodebogota.bancamovil Banco de Bogotá com.tecnocom.cajalaboral Banca Móvil Laboral Kutxa ----- **Package Name** **App Name** com.teb CEPTETEB eu.netinfo.colpatria.system Scotiabank Colpatria com.btcturk.pro BtcTurk PRO - Bitcoin Al-Sat com.citibanamex.banamexmobile Citibanamex Móvil io.cex.app.prod CEX.IO Cryptocurrency Exchange com.plunien.poloniex Poloniex Crypto Exchange pl.raiffeisen.nfc Mobilny Portfel es.openbank.mobile Openbank – banca móvil uk.co.metrobankonline.mobile.android.production Metro Bank com.tmobtech.halkbank Halkbank Mobil uk.co.mbna.cardservices.android MBNA - Card Services App pl.wp.wppoczta WP Poczta pl.ing.mojeing Moje ING mobile com.citibank.CitibankMY Citibank MY pl.pkobp.iko IKO pl.wp.pocztao2 Poczta o2 com.ingbanktr.ingmobil ING Mobil com.tdbank TD Bank (US) om.instagram.android cash.klever.blockchain.wallet Klever Wallet: Buy Bitcoin, Ethereum, Tron, Crypto com.finansbank.mobile.cepsube QNB Finansbank Mobile Banking com.myetherwallet.mewwallet MEW wallet – Ethereum wallet com.finanteq.finance.bgz BNP Paribas GOMobile com.moneybookers.skrillpayments.neteller NETELLER - fast, secure and global money transfers com.grppl.android.shell.halifax Halifax: the banking app that gives you extra cz.mbank mBank CZ com.grupoavaloc1.bancamovil Banco de Occidente Móvil cz.fio.android.smartbroker Fio Smartbroker com.todo1.mobile Bancolombia App Personas uk.co.hsbc.hsbcukmobilebanking HSBC UK Mobile Banking com.ubercab Uber - Request a ride com.Bither.one Bither com.electroneum.mobile Electroneum com.ykb.android Yapı Kredi Mobile com.alibaba.aliexpresshd AliExpress - Smarter Shopping, Better Living uk.co.tescomobile.android Tesco Mobile ----- **Package Name** **App Name** com.microsoft.office.outlook Microsoft Outlook: Organize Your Email & Calendar com.amazon.mShop.android.shopping Amazon Shopping - Search, Find, Ship, and Save pl.nestbank.nestbank Nest Bank nowy pl.noblebank.mobile Noble Mobile com.suntrust.mobilebanking SunTrust Mobile App app.wizink.es WiZink, tu banco senZillo co.bitx.android.wallet Luno: Buy Bitcoin, Ethereum and Cryptocurrency com.grppl.android.shell.BOS Bank of Scotland Mobile Banking: secure on the go cz.csob.ceb ČSOB CEB Mobile com.starfinanz.smob.android.sfinanzstatus Sparkasse Ihre mobile Filiale finansbank.enpara Enpara.com Cep Şubesi eu.eleader.mobilebanking.invest plusbank24 es.bancosantander.empresas Santander Empresas com.bitpay.wallet BitPay – Secure Bitcoin Wallet com.okinc.okex.gp OKEx - Bitcoin/Crypto Trading Platform uk.co.santander.santanderUK Santander Mobile Banking com.comarch.mobile.banking.bgzbnpparibas.biznes Mobile BiznesPl@net tr.gov.turkiye.edevlet.kapisi e-Devlet Kapısı cz.csas.georgego George Česká spořitelna com.grppl.android.shell.CMBlloydsTSB73 Lloyds Bank Mobile Banking: by your side de.commerzbanking.mobil Commerzbank Banking - The app at your side com.mail.mobile.android.mail mail.com mail com.discoverfinancial.mobile Discover Mobile de.comdirect.android comdirect mobile App es.santander.Criptocalculadora Criptocalculadora com.kutxabank.android Kutxabank com.targoes_prod.bad TARGOBANK - Banca a distancia cz.airbank.android My Air pe.pichincha.bm APP Banco Pichincha Perú com.bbva.netcash BBVA Net Cash: ES & PT com.paypal.android.p2pmobile PayPal Mobile Cash: Send and Request Money Fast com.android.vending Google Play pl.bzwbk.bzwbk24 Santander mobile com.bbva.bbvacontigo BBVA Spain payumoney.merchantap com.comarch.security.mobilebanking ING Business ----- **Package Name** **App Name** us.zoom.videomeetings ZOOM Cloud Meetings com.bbva.nxt_peru BBVA Perú com.Plus500 Plus500: CFD Online Trading on Forex and Stocks com.thanksmister.bitcoin.localtrader Local Trader for LocalBitcoins com.ubercab.eats Uber Eats: Food Delivery com.bancocajasocial.geolocation Banco Caja Social Móvil es.caixagalicia.activamovil ABANCA- Banca Móvil de.postbank.finanzassistent Postbank Finanzassistent tsb.mobilebanking TSB Bank Mobile Banking es.liberbank.cajasturapp Banca Digital Liberbank com.yoox YOOX - Fashion, Design and Art com.bitmarket.trader Aplikacja Bitmarket mobile.santander.de Santander Mobile Banking com.pnc.ecommerce.mobile PNC Mobile pl.bps.bankowoscmobilna BPS Mobilnie com.btcturk BtcTurk Bitcoin Borsası com.bankinter.launcher Bankinter Móvil eu.unicreditgroup.hvbapptan HVB Mobile Banking pl.sgb.wallet PORTFEL SGB com.bankia.wallet Bankia Wallet com.cimbmalaysia CIMB Clicks Malaysia com.whatsapp WhatsApp Messenger com.konylabs.HongLeongConnect Hong Leong Connect Mobile Banking net.bitstamp.app Bitstamp – Buy & Sell Bitcoin at Crypto Exchange pl.aliorbank.aib Alior Mobile com.facebook.katana Facebook cz.csob.smartbanking ČSOB Smartbanking com.vakifbank.mobile VakıfBank Mobil Bankacılık com.mediolanum Banco Mediolanum España com.kraken.trade Pro: Advanced Bitcoin & Crypto Trading com.ally.MobileBanking Ally Mobile pe.com.scotiabank.blpm.android.client Scotiabank Perú pl.bph BusinessPro Lite hr.asseco.android.jimba.mUCI.cz Smart Banking com.cajasur.android Cajasur com.finanteq.finance.ca CA24 Mobile ----- **Package Name** **App Name** cz.moneta.smartbanka Smart Banka es.cecabank.ealia2103appstore UniPay Unicaja tr.com.hsbc.hsbcturkey HSBC Turkey com.kuveytturk.mobil Kuveyt Türk com.ebay.mobile eBay: Buy, sell, and save money on home essentials com.ziraat.ziraatmobil Ziraat Mobile com.targo_prod.bad TARGOBANK Mobile Banking com.barclaycardus Barclays US cz.kb.mba.business Mobilní banka Business com.todo1.davivienda.mobileapp Davivienda Móvil hr.asseco.android.jimba.mUCI.sme.cz Business Smart Banking com.fibabanka.Fibabanka.mobile Fibabanka Mobile com.konylabs.capitalone Capital One® Mobile samsung.settings.pass www.ingdirect.nativeframe ING España. Banca Móvil com.infonow.bofa Bank of America Mobile Banking com.nanooqit.economiaemail Centrum.cz mail de.sdvrz.ihb.mobile.app SpardaApp com.mycelium.wallet Mycelium Bitcoin Wallet es.cm.android Bankia pl.mbank mBank PL com.wf.wellsfargomobile Wells Fargo Mobile exodusmovement.exodus Exodus: Crypto Bitcoin Wallet com.cmcmarkets.android.cfd CMC: CFD Trading com.google.android.play.games Google Play Games com.rbs.mobile.android.natwest NatWest Mobile Banking cz.csas.business24 BUSINESS 24 Mobilní banka com.bbt.myfi U by BB&T com.usaa.mobile.android.usaa USAA Mobile piuk.blockchain.android Blockchain Wallet. Bitcoin, Bitcoin Cash, Ethereum com.breadwallet BRD Bitcoin Wallet. Buy BTC Bitcoin Cash, Ethereum com.engage.pbb.pbengage2my.release PB engage MY -----