A more recent preview is currently building, try refreshing in a minute to get a link to the new preview
A more recent preview is available at
The latest preview is already live

Threat Fabric

research

Deceive the Heavens to Cross the sea

Deceive the Heavens to Cross the sea

300.000+ infections via Droppers on Google Play Store

The “Deceive the Heavens to Cross the sea” stratagem comes from the first chapter of the ‘Thirty-Six Stratagems’, a famous Chinese collection of tactics and techniques used in politics, war and civil life. It translates to “hide in plain sight” or “mask your true goals”.

Android banking trojan actors have taken this stratagem to heart and have been very adaptable over years to new Google Play app store restrictions introduced to limit their operations. These restrictions include setting limitations on the use of certain (dangerous) app permissions, which play a big role in distributing or automating malware tactics.

In this blog we will discuss the recent techniques used to spread Android banking trojans via Google Play (MITRE T1475) resulting in significant financial loss for targeted banks. We will also discuss the, sometimes forgotten, by-product of collecting contacts and keystrokes by Banking trojans, resulting in severe data leakage.

Tactics used by threat actors

tactics

What makes these Google Play distribution campaigns very difficult to detect from an automation (sandbox) and machine learning perspective is that dropper apps all have a very small malicious footprint. This small footprint is a (direct) consequence of the permission restrictions enforced by Google Play.

A good example is the modification introduced on November 13th, 2021 by Google, which limits the use of the Accessibility Services, which was abused by earlier dropper campaigns to automate and install apps without user consent.

This policing by Google has forced actors to find ways to significantly reduce the footprint of dropper apps. Besides improved malware code efforts, Google Play distribution campaigns are also more refined than previous campaigns. For example, by introducing carefully planned small malicious code updates over a longer period in Google Play, as well as sporting a dropper C2 backend to fully match the theme of the dropper app (for example a working Fitness website for a workout focused app).

To make themselves even more difficult to detect, the actors behind these dropper apps only manually activate the installation of the banking trojan on an infected device in case they desire more victims in a specific region of the world. This makes automated detection a much harder strategy to adopt by any organization.

VirusTotal does not showcase the evolution of detections of antivirus products over time, but almost all campaigns have or had a 0/62 FUD score on VirusTotal at some point in time, confirming the difficulty of detecting dropper apps with a minimal footprint.

tactics

Families and statistics

In the paragraphs below we outline the Modus Operandi (MO) of each of the families distributed recently via Google Play. Each of these families has its own banking apps target list, which can be found in the Appendix.

tactics

Anatsa campaign

During the research dedicated to the distribution techniques of different malware families, our analysts found numerous droppers located in Google Play, designed to distribute specifically the banking trojan Anatsa. Anatsa was discovered by ThreatFabric in January 2021.

Anatsa is a rather advanced Android banking trojan with RAT and semi-ATS capabilities. It can also perform classic overlay attacks in order to steal credentials, accessibility logging (capturing everything shown on the user’s screen), and keylogging. Previously ThreatFabric reported cases when Anatsa was distributed side-by-side with Cabassous in smishing campaigns all over Europe. Our latest findings show that Anatsa now utilizes Google Play dropper apps.

Thousands of victims

We discovered the first dropper in June 2021 masquerading as an app for scanning documents. In total, ThreatFabric analysts were able to identify 6 Anatsa droppers published in Google Play since June 2021.

Droppers

These apps posed as QR code scanners, PDF scanners, and cryptocurrency apps. One dropper app was installed more than 50.000 times, with the combined total of installations of all droppers reaching more than 100.000 installations.

QR Scanner

The process of infection with Anatsa looks like this: upon the start of installation from Google Play, the user is forced to update the app in order to continue using the app. In this moment, Anatsa payload is downloaded from the C2 server(s), and installed on the device of the unsuspecting victim.

Actors behind it took care of making their apps look legitimate and useful. There are large numbers of positive reviews for the apps. The number of installations and presence of reviews may convince Android users to install the app. Moreover, these apps indeed possess the claimed functionality, after installation they do operate normally and further convince victim in their legitimacy.

Despite the overwhelming number of installations, not every device that has these droppers installed will receive Anatsa, as the actors made efforts to target only regions of their interest. We will cover this and other technical details in the next section.

Technical details

All Anatsa droppers look similar code-wise. Upon the start of the app, a service is started to check if the “update” was installed. The dropper makes a request towards the C2 sending information about the device, including device ID, device name, locale, country, Android SDK version.

C2 communication

As mentioned previously, not every device will receive the “update”. At this point, the C2 backend decides whether to provide the Anatsa payload or not based on the device information. Depending on the C2 response, the dropper will decide whether or not to download Anatsa.

Filtering

Such approach allows actors to target devices from specific regions and easily switch focus to another area. This behavior is in line with Anatsa moving from region to region, constantly updating its list of targeted financial institutions. Moreover, filtering allows cybercriminals to prevent the dropper from downloading the “update” during the evaluation process when publishing the app on Google Play.

Our analysts have identified Anatsa droppers that initially (in their first versions published on Google Play) had no malicious functionality, but modified their behavior in later versions, adding the dropping functionality, and a wider set of permissions required.

Versions

When all conditions are met and the payload is ready, the user will be prompted to download and install it.

Update process

After successfully downloading the “update”, the user will be asked for the permission to install apps from unknown sources. The user, previously convinced that the update is necessary for the app to work properly, grants the permission. After the installation is complete, Anatsa is running on the device and immediately asks the victim to grant Accessibility Service privileges.

Anatsa

After enabling Accessibility Service, Anatsa has full control over the device and can perform actions on the victim’s behalf. At the same time, the dropper app is also running and operating as a legitimate app, the victim will probably remain unsuspecting.

Hydra and Ermac campaign

Brunhilda : The return of the Valkyrie

ThreatFabric identified multiple instances of malware dropped by the Brunhilda threat actor group, and in line with previous campaigns, it constituted of trojanized apps. Brunhilda was observed dropping different malware families.

In the first case, we observed Brunhilda posing as a QR code creator app, Brunhilda dropped samples from established families, like Hydra, as well as novel ones, like Ermac.

Brunhilda  dropping Hydra and Ermac on GP

The apps dropped by this Brunhilda campaign do not differ in functioning too much from the previous versions we have observed during 2021. As it did in the previous iterations, Brunhilda sends a registration request to its C2 using the gRPC protocol. Upon successful registration, and after communicating more detailed information about the device, the dropper is instructed by the C2 to download and install the payload package.

Brunhilda installation

Both families have been very active in the last months, even adventuring to markets that were previously untapped, like the United States. This new wave of malware, which started in August 2021, includes also other families like Gustuff and Anatsa.

US campaigns

Alien campaign

As mentioned before, ThreatFabric observed Brunhilda serving different malware families. Some samples were observed having more than 50.000+ installations, and dropping the android trojan Alien.

Brunhilda dropping Alien on GP

Also in this case, as it happened with the deployment of Vultur, these aps reached thousands of downloads before being taken down from the store. The samples were very successful in their operation, with samples ranging from 5.000+ downloads to the impressive values of 50.000+ downloads. With these numbers in mind, it is fair to say that this dropper family was likely able to infect hundreds of thousands of victims during its operation.

Gymdrop : a Gym you do not want to visit

In November 2021 ThreatFabric analysts discovered yet another dropper in Google Play. It had 10.000+ installations and masquerades as an app for self-training.

Gymdrop

This dropper, that we dubbed “Gymdrop”, is another example of how cybercriminals try to convince victims and detection systems that their app is legitimate. The app website is designed to look legitimate at first glance. However, it is only a template for a gym website with no useful information on it, even still containing ‘Lorem Ipsum’ placeholder text in its pages.

Developer website

The developer website also serves as C2 for Gymdrop. Just like previously observed, this dropper tried to convince victims to install a fake update. However, in this case, it is done in a more inventive way: the payload is posed as a new package of workout exercises in conformity with the app. After the user clicks “OK”, the dropper will request the permissions needed.

Gymdrop update process

Shortly after the dropper gets its configuration from the C2. The configuration file contains the link to download the payload. Moreover, the configuration contains filter rules based on device model. Based on the models being filtered out and the code of the dropper, we can draw a conclusion that this is done to avoid downloading the payload on emulators or research environment.

Gymdrop filtering

If all conditions are met, the payload will be downloaded and installed. This dropper also does not request Accessibility Service privileges, it just requests permission to install packages, spiced with the promise to install new workout exercises - to entice the user to grant this permission. When installed, the payload is launched. Our threat intelligence shows that at the moment this dropper is used to distribute Alien banking trojan.

Alien installation

While writing this blog post, Gymdrop was updated (a new version was uploaded to Google Play). However, the configuration file was not found on C2. It could probably be done to not serve the payload to pass security checks performed by Google before publishing the update on Google Play.

2 dropper APPS to boost botnet-building

It is worth mentioning that the Alien samples of this campaign connect to the same C2 as samples from previously described campaign powered by Brunhilda dropper.

Alien campaigns

This leads us to the conclusion that the actor(s) behind these Alien campaigns use at least 2 different dropper services in their distribution strategy.

Conclusion

timeline on GP

In the span of only 4 months, 4 large Android families were spread via Google Play, resulting in 300.000+ infections via multiple dropper apps.

A noticeable trend in the new dropper campaigns is that actors are focusing on loaders with a reduced malicious footprint in Google Play, considerably increasing the difficulties in detecting them with automation and machine learning techniques.

The small malicious footprint is a result of the new Google Play restrictions (current and planned) to put limitations on the use of privacy concerning app permissions. Permissions such as Accessibility Service, which in previous campaigns was one of the core tactics abused to automate the installation process of Android banking trojans via dropper apps in Google Play.

By limiting the use of these permissions, actors were forced to choose the more conventional way of installing apps, which is by asking the installation permission, with the side-effect of blending in more with legitimate apps. This is one of the core reasons of the significant success of mobile banking threat actors in sneaking into Google’s trusted app store.

A second big factor behind their success is that actors have set restrictions, with mechanisms to ensure that the payload is installed only on the victim’s device and not on testing environments. To achieve this, criminals use a multitude of techniques, which range from location checks to incremental malicious updates, passing by time-based de-obfuscation and server-side emulation checks.

This incredible attention dedicated to evading unwanted attention renders automated malware detection less reliable. This consideration is confirmed by the very low overall VirusTotal score of the 9 number of droppers we have investigated in this blogpost.

How we help our customers

ThreatFabric makes it easier than it has ever been to run a secure mobile payments business. With the most advanced threat intelligence for mobile banking, financial institutions can build a risk-based mobile security strategy and use this unique knowledge to detect fraud-by-malware on the mobile devices of customers in real-time.

Together with our customers and partners, we are building an easy-to-access information system to tackle the ever-growing threat of mobile malware targeting the financial sector. We especially like to thank the Cyber Defence Alliance (CDA) for collaborating and proactively sharing knowledge and information across the financial sector to fight cyber-threats.

ThreatFabric has partnerships with TIPs all over the world.

If you want to request a free trial of our MTI-feed, or want to test our own MTI portal for 30 days, feel free to contact us at: sales@threatfabric.com

If you want more information on how we detect mobile malware on mobile devices, you can directly contact us at: info@threatfabric.com

Appendix: IOC

Brunhilda Dropper Samples

App name Package name SHA-256
Two Factor Authenticator com.flowdivison a3bd136f14cc38d6647020b2632bc35f21fc643c0d3741caaf92f48df0fc6997
Protection Guard com.protectionguard.app d3dc4e22611ed20d700b6dd292ffddbc595c42453f18879f2ae4693a4d4d925a
QR CreatorScanner com.ready.qrscanner.mix ed537f8686824595cb3ae45f0e659437b3ae96c0a04203482d80a3e51dd915ab
Master Scanner Live com.multifuction.combine.qr 7aa60296b771bdf6f2b52ad62ffd2176dc66cb38b4e6d2b658496a6754650ad4

Brunhilda Dropper C2 URL

URL
hxxps://protectionguardapp[.]club
hxxps://readyqrscanner[.]club
hxxps://flowdivison[.]club
hxxps://multifuctionscanner[.]club

Anatsa Dropper Samples

App name Package name SHA-256
QR Scanner 2021 com.qr.code.generate 2db34aa26b1ca5b3619a0cf26d166ae9e85a98babf1bc41f784389ccc6f54afb
QR Scanner com.qr.barqr.scangen d4e9a95719e4b4748dba1338fdc5e4c7622b029bbcd9aac8a1caec30b5508db4
PDF Document Scanner - Scan to PDF com.xaviermuches.docscannerpro2 2080061fe7f219fa0ed6e4c765a12a5bc2075d18482fa8cf27f7a090deca54c5
PDF Document Scanner com.docscanverifier.mobile 974eb933d687a9dd3539b97821a6a777a8e5b4d65e1f32092d5ae30991d4b544
PDF Document Scanner Free com.doscanner.mobile 16c3123574523a3f1fb24bbe6748e957afff21bef0e05cdb3b3e601a753b8f9d
CryptoTracker cryptolistapp.app.com.cryptotracker 1aafe8407e52dc4a27ea800577d0eae3d389cb61af54e0d69b89639115d5273c

Anatsa Dropper C2 URL

URL
hxxp://195.201.70.88/api/update
hxxp://178.63.27.179/api/update
hxxp://91.242.229.85/api/update
hxxp://195.201.70.89/api/update

Gymdrop Dropper Samples

App name Package name SHA-256
Gym and Fitness Trainer com.gym.trainer.jeux 30ee6f4ea71958c2b8d3c98a73408979f8179159acccc01b6fd53ccb20579b6b
Gym and Fitness Trainer com.gym.trainer.jeux b3c408eafe73cad0bb989135169a8314aae656357501683678eff9be9bcc618f

Gymdrop Dropper C2 URL

URL
hxxps://onlinefitnessanalysis[.]com/

Malware Samples dropped

Malware Family App name Package name SHA-256
Alien.A Master Scanner Live leaf.leave.exchang 74407e40e1c01e73087442bcdf3a0802121c4263ab67122674d9d09b3edf856e
Alien.A Gym and Fitness Trainer gesture.enlist.say e8cbcc34af3bd352767b7a9270dd684a50da2e68976a3712675526a7398550a0
Anatsa.A PDF AI : TEXT RECOGNIZER com.uykxx.noazg d42e0d3db3662e809af3198da67fdbd46d5c2a1052b5945401e4cdd06c197714
Hydra.C QR CreatorScanner com.cinnamon.equal 9ab66c1b7db44abaa53850a3d6a9af36c8ad603dab6900caba592497f632349f
Ermac.A QR CreatorScanner com.tag.right fd7e7e23db5f645db9ed47a5d36e7cf57ca2dbdf46a37484eafa1e04f657bf02

Appendix: Targeted apps

Alien.A Targets

Package Name App Name
com.kubi.kucoin KuCoin: Bitcoin Exchange & Crypto Wallet
com.abanca.bm.pt ABANCA - Portugal
com.bitfinex.mobileapp Bitfinex
com.changelly.app Changelly: Buy Bitcoin BTC & Fast Crypto Exchange
es.liberbank.cajasturapp Banca Digital Liberbank
wit.android.bcpBankingApp.millennium Millenniumbcp
es.openbank.mobile Openbank – banca móvil
pt.bctt.appbctt Banco CTT
com.exictos.mbanka.bic Banco BIC, SA
com.kraken.trade Pro: Advanced Bitcoin & Crypto Trading
com.plunien.poloniex Poloniex Crypto Exchange
com.kutxabank.android Kutxabank
com.bitpay.wallet BitPay – Secure Bitcoin Wallet
com.binance.dev Binance - Buy & Sell Bitcoin Securely
com.bbva.netcash BBVA Net Cash ES & PT
com.coinbase.android Coinbase – Buy & Sell Bitcoin. Crypto Wallet
com.rsi.Colonya Colonya Caixa Pollença
com.transferwise.android TransferWise Money Transfer
pt.bancobpi.mobile.fiabilizacao BPI APP
com.bancamarch.bancamovil Banca March
com.mycelium.wallet Mycelium Bitcoin Wallet
com.cajasur.android Cajasur
com.tecnocom.cajalaboral Banca Móvil Laboral Kutxa
net.bitbay.bitcoin Bitcoin & Crypto Exchange - BitBay
es.evobanco.bancamovil EVO Banco móvil
com.bankinter.portugal.bmb Bankinter Portugal
com.google.android.gm Gmail
pt.bancobest.android.mobilebanking Best Bank
com.wavesplatform.wallet Waves.Exchange
net.bitstamp.app Bitstamp – Buy & Sell Bitcoin at Crypto Exchange
es.bancosantander.apps Santander
com.microsoft.office.outlook Microsoft Outlook: Organize Your Email & Calendar
com.okinc.okex.gp OKEx - Bitcoin/Crypto Trading Platform
com.grupocajamar.wefferent Grupo Cajamar
com.bankinter.launcher Bankinter Móvil
es.cm.android Bankia
pt.novobanco.nbapp NB smart app
com.cajaingenieros.android.bancamovil Caja de Ingenieros Banca MÓVIL
es.ibercaja.ibercajaapp Ibercaja
pt.santandertotta.mobileempresas Santander Empresas
es.pibank.customers Pibank
piuk.blockchain.android Blockchain Wallet. Bitcoin, Bitcoin Cash, Ethereum
com.indra.itecban.mobile.novobanco NBapp Spain
com.mediolanum Banco Mediolanum España
com.android.vending Google Play
com.bbva.mobile.pt BBVA Portugal
com.squareup.cash Cash App
es.caixagalicia.activamovil ABANCA- Banca Móvil
es.univia.unicajamovil UnicajaMovil
org.electrum.electrum Electrum Bitcoin Wallet
app.wizink.es WiZink, tu banco senZillo
com.yahoo.mobile.client.android.mail Yahoo Mail – Organized Email
cgd.pt.caixadirectaparticulares Caixadirecta
com.connectivityapps.hotmail Connect for Hotmail & Outlook: Mail and Calendar
com.mail.mobile.android.mail mail.com mail
com.imaginbank.app imaginBank - Your mobile bank
es.caixaontinyent.caixaontinyentapp Caixa Ontinyent
www.ingdirect.nativeframe ING España. Banca Móvil
eu.atlantico.bancoatlanticoapp MY ATLANTICO
com.bbva.bbvacontigo BBVA Spain
com.citi.mobile.ccc CitiManager – Corporate Cards
ca.mobile.explorer CA Mobile
com.paypal.android.p2pmobile PayPal Mobile Cash: Send and Request Money Fast
com.rsi ruralvía
es.cecabank.ealia2103appstore UniPay Unicaja
wit.android.bcpBankingApp.activoBank ActivoBank
com.indra.itecban.triodosbank.mobile.banki -
es.lacaixa.mobile.android.newwapicon CaixaBank
com.db.pbc.mibanco Mi Banco db
com.targoes_prod.bad TARGOBANK - Banca a distancia

Ermac.A Targets

Package Name App Name
eu.inmite.prj.kb.mobilbank Mobilni Banka
com.greater.Greater Greater Bank
uk.co.tsb.newmobilebank TSB Mobile Banking
org.microemu.android.model.common.VTUserApplicationLINKMB Link Celular
es.lacaixa.mobile.android.newwapicon CaixaBank
com.IngDirectAndroid ING France
es.bancosantander.apps Santander
com.ocito.cdn.activity.creditdunord Crédit du Nord pour Mobile
pl.ideabank.mobilebanking Idea Bank PL
gt.com.bi.bienlinea Bi en Línea
org.banking.bsa.businessconnect BankSA Business App
pl.envelobank.aplikacja EnveloBank
net.inverline.bancosabadell.officelocator.android Banco Sabadell App. Your mobile bank
com.msf.kbank.mobile Kotak - 811 & Mobile Banking
au.com.ingdirect.android ING Australia Banking
com.getingroup.mobilebanking Getin Mobile
au.com.amp.myportfolio.android My AMP
com.magiclick.odeabank Odeabank
com.mtel.androidbea BEA 東亞銀行
eu.eleader.mobilebanking.pekao.firm PekaoBiznes24
org.banking.stg.businessconnect St.George Business App
softax.pekao.powerpay PeoPay
com.rsi ruralvía
my.com.hsbc.hsbcmalaysia HSBC Malaysia
com.td TD Canada
org.banksa.bank BankSA Mobile Banking
org.bom.bank Bank of Melbourne Mobile Banking
com.zoluxiones.officebanking Banco Santander Perú S.A.
com.pcfinancial.mobile Simplii Financial
es.evobanco.bancamovil EVO Banco móvil
com.latuabancaperandroid Intesa Sanpaolo Mobile
com.fusion.beyondbank Beyond Bank Australia
com.rbs.mobile.android.rbs Royal Bank of Scotland Mobile Banking
com.unicredit Mobile Banking UniCredit
com.tarjetanaranja.emisor.serviciosClientes.appTitulares Naranja
au.com.newcastlepermanent NPBS Mobile Banking
au.com.suncorp.SuncorpBank Suncorp Bank
de.traktorpool tractorpool
hu.cardinal.erste.mobilapp Erste Business MobilBank
au.com.bankwest.mobile Bankwest
it.popso.SCRIGNOapp SCRIGNOapp
de.dkb.portalapp DKB-Banking
pe.com.interbank.mobilebanking Interbank APP
it.copergmps.rt.pf.android.sp.bmps Banca MPS
de.consorsbank Consorsbank
com.isis_papyrus.raiffeisen_pay_eyewdg Raiffeisen ELBA
de.fiducia.smartphone.android.banking.vr VR Banking Classic
com.pozitron.iscep İşCep - Mobile Banking
wit.android.bcpBankingApp.millenniumPL Bank Millennium
es.ibercaja.ibercajaapp Ibercaja
alior.bankingapp.android Usługi Bankowe
com.krungsri.kma KMA
it.ingdirect.app ING Italia
com.mobillium.papara Papara
de.adesso_mobile.secureapp.netbank SecureApp netbank
com.nearform.ptsb permanent tsb
com.konylabs.cbplpat Citi Handlowy
com.lynxspa.bancopopolare YouApp
tr.com.sekerbilisim.mbank ŞEKER MOBİL ŞUBE
com.appfactory.tmb Teachers Mutual Bank
au.com.mebank.banking ME Bank
com.kasikorn.retail.mbanking.wap K PLUS
com.infrasofttech.MahaBank Maha Mobile
com.pttfinans PTTBank
es.univia.unicajamovil UnicajaMovil
au.com.commbank.commbiz.prod CommBiz
my.com.maybank2u.m2umobile Maybank2u MY
es.pibank.customers Pibank
de.ingdiba.bankingapp ING Banking to go
com.fusion.banking Bank Australia app
com.tecnocom.cajalaboral Banca Móvil Laboral Kutxa
pegasus.project.ebh.mobile.android.bundle.mobilebank George Magyarország
au.com.rams.RAMS myRAMS
com.teb CEPTETEB
eu.netinfo.colpatria.system Scotiabank Colpatria
de.santander.presentation Santander Banking
es.openbank.mobile Openbank – banca móvil
pl.raiffeisen.nfc Mobilny Portfel
pt.novobanco.nbapp NB smart app
uk.co.metrobankonline.mobile.android.production Metro Bank
com.tmobtech.halkbank Halkbank Mobil
de.mobile.android.app mobile.de – Germany‘s largest car market
net.bnpparibas.mescomptes Mes Comptes BNP Paribas
com.mercadolibre Mercado Libre: compra fácil y rápido
uk.co.mbna.cardservices.android MBNA - Card Services App
hu.cardinal.cib.mobilapp CIB Business Online
fr.creditagricole.androidapp Ma Banque
jp.co.rakuten_bank.rakutenbank 楽天銀行 -個人のお客様向けアプリ
org.banking.bom.businessconnect Bank of Melbourne Business App
pl.ing.mojeing Moje ING mobile
pl.pkobp.ipkobiznes iPKO biznes
com.usbank.mobilebanking U.S. Bank - Inspired by customers
pl.pkobp.iko IKO
com.anz.transactive.global ANZ Transactive - Global
com.bankofqueensland.boq BOQ Mobile
com.ingbanktr.ingmobil ING Mobil
com.tdbank TD Bank (US)
com.scb.phone SCB EASY
com.Version1 PNB ONE
net.garagecoders.e_llavescotiainfo ScotiaMóvil
nz.co.asb.asbmobile ASB Mobile Banking
com.finanteq.finance.bgz BNP Paribas GOMobile
com.woodforest Woodforest Mobile Banking
ro.btrl.mobile Banca Transilvania
uk.co.hsbc.hsbcukmobilebanking HSBC UK Mobile Banking
com.todo1.mobile Bancolombia App Personas
com.uy.itau.appitauuypf Itaú Uruguay
com.key.android KeyBank Mobile
it.bnl.apps.banking BNL
au.com.cua.mb CUA Mobile Banking
com.ykb.android Yapı Kredi Mobile
ktbcs.netbank Krungthai NEXT
com.santander.bpi Santander Private Banking
posteitaliane.posteapp.apppostepay Postepay
uk.co.tescomobile.android Tesco Mobile
es.ceca.cajalnet Cajalnet
com.scotiabank.banking Scotiabank Mobile Banking
it.nogood.container UBI Banca
pl.noblebank.mobile Noble Mobile
com.suntrust.mobilebanking SunTrust Mobile App
pl.eurobank2 eurobank mobile 2.0
com.mobileloft.alpha.droid myAlpha Mobile
com.unionbank.ecommerce.mobile.android Union Bank Mobile Banking
pl.millennium.corpApp Bank Millennium for Companies
au.com.hsbc.hsbcaustralia HSBC Australia
com.starfinanz.smob.android.sfinanzstatus Sparkasse Ihre mobile Filiale
org.westpac.col Westpac Corporate Mobile
au.com.macquarie.banking Macquarie Mobile Banking
finansbank.enpara Enpara.com Cep Şubesi
org.stgeorge.bank St.George Mobile Banking
com.mcom.firstcitizens First Citizens Mobile Banking
fr.laposte.lapostemobile La Poste - Services Postaux
es.bancosantander.empresas Santander Empresas
fr.lcl.android.customerarea Mes Comptes - LCL
fr.banquepopulaire.cyberplus Banque Populaire
uk.co.santander.santanderUK Santander Mobile Banking
com.comarch.mobile.banking.bgzbnpparibas.biznes Mobile BiznesPl@net
pl.fakturownia Fakturownia.pl
pt.bancobpi.mobile.fiabilizacao BPI APP
de.commerzbanking.mobil Commerzbank Banking - The app at your side
de.comdirect.android comdirect mobile App
com.kutxabank.android Kutxabank
pt.santandertotta.mobileparticulares Santander Particulares
es.caixageral.caixageralapp Banco Caixa Geral España
com.itau.empresas Itaú Empresas: Controle e Gestão do seu Negócio
wit.android.bcpBankingApp.millennium Millenniumbcp
com.sbi.SBIFreedomPlus Yono Lite SBI - Mobile Banking
fr.oney.mobile.mescomptes Oney France
pl.bzwbk.bzwbk24 Santander mobile
com.vancity.mobileapp Vancity
com.comarch.security.mobilebanking ING Business
com.snapwork.hdfc HDFC Bank MobileBanking
es.caixagalicia.activamovil ABANCA- Banca Móvil
tsb.mobilebanking TSB Bank Mobile Banking
com.zellepay.zelle Zelle
ma.gbp.pocketbank Pocket Bank
de.postbank.finanzassistent Postbank Finanzassistent
com.bendigobank.mobile Bendigo Bank
es.liberbank.cajasturapp Banca Digital Liberbank
hu.bb.mobilapp Budapest Bank Mobil App
com.pnc.ecommerce.mobile PNC Mobile
eu.atlantico.bancoatlanticoapp MY ATLANTICO
pl.bps.bankowoscmobilna BPS Mobilnie
eu.unicreditgroup.hvbapptan HVB Mobile Banking
com.konylabs.HongLeongConnect Hong Leong Connect Mobile Banking
pl.aliorbank.aib Alior Mobile
com.mfoundry.mb.android.mb_136 People’s United Bank Mobile
au.com.ubank.internetbanking UBank Mobile Banking
de.number26.android N26 — The Mobile Bank
cz.csob.smartbanking ČSOB Smartbanking
mobi.societegenerale.mobile.lappli L’Appli Société Générale
com.vakifbank.mobile VakıfBank Mobil Bankacılık
com.anz.android.gomoney ANZ Australia
mbanking.NBG NBG Mobile Banking
pl.bph BusinessPro Lite
com.finanteq.finance.ca CA24 Mobile
com.quoine.quoinex.light Liquid by Quoineライト版(リキッドバイコイン) -ビットコインなどの仮想通貨取引所
enterprise.com.anz.shield ANZ Shield
pl.bzwbk.ibiznes24 iBiznes24 mobile
tr.com.hsbc.hsbcturkey HSBC Turkey
com.kuveytturk.mobil Kuveyt Türk
com.ziraat.ziraatmobil Ziraat Mobile
com.targo_prod.bad TARGOBANK Mobile Banking
au.com.nab.mobile NAB Mobile Banking
com.samba.mb SambaMobile
org.westpac.bank Westpac Mobile Banking
pl.ifirma.ifirmafaktury IFIRMA - Darmowy Program do Faktur
com.rbc.mobile.android RBC Mobile
com.tideplatform.banking Tide - Smart Mobile Banking
com.sbi.SBAnywhereCorporate SBI Anywhere Corporate
hu.mkb.mobilapp MKB Mobilalkalmazás
com.todo1.davivienda.mobileapp Davivienda Móvil
jp.co.netbk 住信SBIネット銀行
com.navyfederal.android Navy Federal Credit Union
com.infrasofttech.CentralBank Cent Mobile
com.konylabs.capitalone Capital One® Mobile
es.cm.android Bankia
pl.mbank mBank PL
com.wf.wellsfargomobile Wells Fargo Mobile
gr.winbank.mobilenext Winbank Mobile
com.westernunion.moneytransferr3app.es Western Union ES - Send Money Transfers Quickly
com.snapwork.IDBI IDBI Bank GO Mobile+
com.commbank.netbank CommBank
mx.bancosantander.supermovil Santander móvil
com.rbs.mobile.android.natwest NatWest Mobile Banking
it.carige Carige Mobile
com.usaa.mobile.android.usaa USAA Mobile
eu.eleader.mobilebanking.pekao Pekao24Makler

Anatsa.A Targets

Package Name App Name
uk.co.hsbc.hsbcukmobilebanking HSBC UK Mobile Banking
com.chase.sig.android Chase Mobile
com.wf.wellsfargomobile Wells Fargo Mobile
com.citi.citimobile Citi Mobile®
com.konylabs.capitalone Capital One® Mobile
com.infonow.bofa Bank of America Mobile Banking
com.jpm.sig.android J.P. Morgan Mobile
com.usbank.mobilebanking U.S. Bank - Inspired by customers
com.truist.mobile Truist Mobile - Banking Made Better
com.pnc.ecommerce.mobile PNC Mobile
com.tdbank TD Bank (US)
com.schwab.mobile Schwab Mobile
com.statestreetbank.grip State Street Bank
us.hsbc.hsbcus HSBC US
com.citizensbank.androidapp Citizens Bank Mobile Banking
com.syf.synchronybank Synchrony Bank
com.creditonebank.mobile Credit One Bank Mobile
com.monitise.client.android.clydesdale Clydesdale Bank Mobile Banking
com.fidelity.android Fidelity Investments
us.current.android Earn Cash Reward: Make Money Playing Games & Music
com.robinhood.android Robinhood - Investment & Trading, Commission-free
com.moneylion MoneyLion: Mobile Banking App
com.sablemoney.sableapp.prod Sable
com.virginmoney.uk.mobile.android Virgin Money Mobile Banking
com.monitise.client.android.yorkshire Yorkshire Bank Mobile Banking
com.monitise.client.android.clydesdale Clydesdale Bank Mobile Banking
com.algorand.android Algorand Wallet
com.coinbase.android Coinbase – Buy & Sell Bitcoin. Crypto Wallet
co.mona.android Crypto.com - Buy Bitcoin Now
com.monese.monese.live Monese - Mobile Money Account for UK & Europe
com.binance.dev Binance - Buy & Sell Bitcoin Securely
com.danskebank.mobilebank3.uk Mobile Bank UK – Danske Bank
com.rbs.mobile.android.ubn Ulster Bank NI Mobile Banking
com.rbs.mobile.android.natwest NatWest Mobile Banking
com.rbs.mobile.android.natwestoffshore NatWest International
com.plunien.poloniex Poloniex Crypto Exchange
com.wallet.crypto.trustapp Trust: Crypto & Bitcoin Wallet
com.cooperativebank.bank The Co-operative Bank
uk.co.metrobankonline.mobile.android.production Metro Bank
com.starlingbank.android Starling Bank - Better Mobile Banking
io.metamask MetaMask - Buy, Send and Swap Crypto
co.uk.getmondo Monzo Bank
com.binance.us Binance.US
com.kraken.invest.app Kraken - Buy Bitcoin & Crypto
com.blockfolio.blockfolio Blockfolio - Bitcoin and Cryptocurrency Tracker
com.gemini.android.app Gemini: Buy Bitcoin Instantly
com.okinc.okcoin.intl Okcoin - Buy & Trade Bitcoin, Ethereum, & Crypto
com.barclays.android.barclaysmobilebanking Barclays
com.tideplatform.banking Tide - Smart Mobile Banking
com.grppl.android.shell.halifax Halifax: the banking app that gives you extra
com.grppl.android.shell.CMBlloydsTSB73 Lloyds Bank Mobile Banking: by your side
com.usaa.mobile.android.usaa USAA Mobile
com.blockfi.mobile BlockFi - Buy, Earn, Borrow Crypto
com.marcus.android Marcus by Goldman Sachs®
com.unionbank.ecommerce.mobile.android Union Bank Mobile Banking
org.penfed.mobile.banking PenFed
com.navyfederal.android Navy Federal Credit Union
com.stash.stashinvest Stash: Invest, Bank, Save
com.regions.mobbanking Regions Bank
com.varomoney.bank Varo Bank: Mobile Banking
com.current.app Current - Modern Banking
com.huntington.m Huntington Mobile
com.clairmail.fth Fifth Third Mobile Banking
com.mint Mint: Personal Finance Manager
piuk.blockchain.android Blockchain Wallet. Bitcoin, Bitcoin Cash, Ethereum
com.q2e.texasdowcreditunion5004401st.mobile.production TDECU Digital Banking
pr.com.firstbank FirstBank Digital Banking App
com.oneazcu.banking OneAZ Mobile Banking
com.axos.udb Axos Bank®
com.etrade.mobilepro.activity E*TRADE: Invest. Trade. Save.
org.suncoast.mobile Suncoast SunMobile
com.firsttech.firsttech First Tech Federal CU
org.ncsecu.mobile SECU
org.ncsecu.mobile SECU
com.softek.ofxclmobile.warrenfcu Blue FCU Mobile Banking App
com.bethpage.bethpage Bethpage Mobile Banking
com.myoccu.mobile MyOCCU Mobile Banking
com.ifs.banking.fiid3160 Tru2Go Truliant Mobile Banking
com.desertschools.mobilebanking Desert Financial Mobile
com.nymfcu.nymfcu NYMCU Mobile Banking
com.softek.ofxclmobile.summitcu Summit Credit Union Mobile
com.fi7453.godough PFFCU Mobile Banking
com.cuamerica.cuamerica Credit Union of America
com.ifs.banking.fiid3337 Arizona Federal Mobile Banking
com.ksfcu.ksfcu Valley Strong DataMobile
com.ifs.mobilebanking.fiid9094 Service CU Mobile Banking
com.scottcreditunion5029.mobile Scott Credit Union
com.socalcu.socalcu CU SoCal Mobile Banking
com.q2e.unitedfcu5017android.ufcu.uwnmobile United Federal Credit Union
com.credituniononecu.credituniononecu NEW - Credit Union One Michigan
mobile.dcfcu.org DCFCU Mobile
com.ifs.mobilebanking.fiid3919 Associated Credit Union Mobile
com.ifs.banking.fiid1359 WPCU Mobile Banking
com.growfinancialfcu.growfinancialfcu Grow Mobile Banking
com.nexowallet Nexo - Crypto Banking Account
com.investvoyager Voyager: Crypto Made Simple
com.mobileloft.alpha.droid myAlpha Mobile
mbanking.NBG NBG Mobile Banking
com.vivawallet.business Viva Wallet
gr.winbank.mobilenext Winbank Mobile
com.EurobankEFG Eurobank Mobile App
io.sperax.wallet Sperax Play
ru.sberbankmobile Сбербанк Онлайн
ru.otpbank.mobile ОТП Банк
ru.letobank.Prometheus Почта Банк
ge.lb.mobilebank Liberty
com.idamob.tinkoff.android Tinkoff
ru.bankuralsib.mb.android Мобильный банк УРАЛСИБ
gr.nbg.go4more go4more
com.ubanksu UBANK
ru.vtb24.mobilebanking.android VTB-Online
com.mtbank Мой банк
com.columbiabank3685.mobile.production Columbia Bank
com.capital.etf.trade Investments - Capital.com
ch.raiffeisen.twint Raiffeisen TWINT
ch.postfinance.twint.android PostFinance TWINT
com.csg.creditsuisse.twint Credit Suisse TWINT – mobile payment app
ch.postfinance.android PostFinance Mobile
com.csg.cs.dnmb Credit Suisse Direct
com.ubs.swidK2Y.android UBS Access – secure login for digital banking
com.ubs.swidKXJ.android UBS Mobile Banking: E-Banking and mobile pay
com.neonbanking.app neon - your account app
ch.raiffeisen.android Raiffeisen E-Banking
com.flowbank.client FlowBank
ch.bankcler.zak Bank Cler Zak
com.axa.android.smartclaims.ch MyAXA CH
ch.zkb.slv.mobile.client.android eBanking Mobile
com.swissborg.android SwissBorg: Invest in Crypto
ch.zkb.twint ZKB TWINT
ch.zkb.frankly frankly. Pillar 3a – Private pension
ch.bcv.mobile.android BCV Mobile
at.rsg.pfp Mein ELBA-App
at.erstebank.george George Österreich
at.erstebank.securityapp s Identity
com.bawagpsk.bawagpsk BAWAG PSK klar – Mobile Banking App
com.bankaustria.android.olb Bank Austria MobileBanking
at.tmobile.android.myt Mein Magenta (AT)
com.bitpanda.bitpanda Bitpanda - Buy Bitcoin in minutes
at.volksbank.volksbankmobile Volksbank hausbanking
at.ing.diba.client.onlinebanking ING Banking Austria
com.easybank.easybank easybank App
at.oberbank.mbanking Oberbank
de.xcom.flatexat flatex AT
com.cardcomplete.completecontrol complete Control
at.bank99.meine.meine meine99 Online Banking
at.bks.mbanking BKS Bank Österreich
at.racon.mandantvkb VKB CONNECT
com.csiweb.digitalbanking.bk0617 Viking Bank Mobile
com.csiweb.digitalbanking.bk0710 Minnesota National Bank
dk.bec.android.mb1.b00369.prod Spar Nord Mobilbank
dk.bec.android.mb1.b00020.prod AL-Bank
dk.jyskebank.drb Jyske Bank
dk.landbobanken.drb Ringkjøbing Landbobank og Nordjyske Bank
dk.bec.android.mb1.b00019.prod Vestjysk Bank
dk.nordea.mobilebank Nordea Mobile - Denmark
dk.sydbank.drb Sydbanks Mobilbank Privat
com.resurs.rbapp Resurs Bank
com.danskebank.mobilebank3.dk NY mobilbank DK - Danske Bank
nz.co.cooperativebank The Co-operative Bank (NZ)
nz.co.anz.android.mobilebanking ANZ goMoney New Zealand
nz.co.asb.asbmobile ASB Mobile Banking
nz.co.asb.asbmobile ASB Mobile Banking
nz.co.kiwibank.mobile Kiwibank Mobile Banking
nz.co.westpac Westpac One (NZ) Mobile Banking
com.commbank.netbank CommBank
au.com.nab.mobile NAB Mobile Banking
com.anz.android.gomoney ANZ Australia
org.westpac.bank Westpac Mobile Banking
com.bendigobank.mobile Bendigo Bank
au.com.ingdirect.android ING Australia Banking
org.stgeorge.bank St.George Mobile Banking
au.com.bankwest.mobile Bankwest
com.coinspot.app CoinSpot - Buy & Sell Bitcoin
org.banksa.bank BankSA Mobile Banking
au.com.heritage.app Heritage Mobile Banking
org.bom.bank Bank of Melbourne Mobile Banking
au.com.cua.mb CUA Mobile Banking
au.com.swyftx Swyftx Cryptocurrency Exchange - Buy, Sell & Trade
com.citibank.mobile.au Citibank Australia
au.com.mebank.banking ME Bank
au.com.newcastlepermanent NPBS Mobile Banking
com.fusion.beyondbank Beyond Bank Australia
com.bankofqueensland.boq BOQ Mobile
com.adcb.cbgdigi ADCB Hayyak: Start your banking relationship now!
com.cbd.mobile CBD
com.dib.app DIB MOBILE
com.mashreq.NeoApp Mashreq Neo - Bank easy
com.adcb.bank ADCB
enbd.mobilebanking Emirates NBD
com.fab.personalbanking FAB Mobile
com.adib.mobile ADIB Mobile Banking App
com.rak RAKBANK Digital Banking
com.adib.smartmoney smartbanking by ADIB
com.alhilal.hayyak Ahlan by Al Hilal Bank
com.kubi.kucoin KuCoin: Bitcoin Exchange & Crypto Wallet
com.mbc.anb.keystore ANB Mobile~ Arab National Bank
com.phonepe.app PhonePe: UPI, Recharge, Investment, Insurance
com.rainmanagement.rain Rain: Buy & Sell Bitcoin
com.BanqueMisr.MobileBanking BM Online
com.riyadbank.strategic RiyadBank Mobile
sa.liv.android Liv. KSA - Digital Banking
com.alahli.mobile.android SNB AlAhli Mobile
com.alrajhiretailapp Al Rajhi Mobile
com.samba.mb SambaMobile
com.sabb.mobilebanking SABBMobile
com.bsffm FransiMobile
com.alinma.retail.mobile Alinma Bank
com.saib.banking.mobile.android SAIB
com.slsp.mtoken SLSP mToken
sk.slsp.georgego George Go Slovensko
bank.sk365.app 365.bank
sk.tb.ib.tatraandroid Tatra banka
sk.csob.smarttoken CSOB SmartToken
com.zentity.sbank.csobsk SmartBanking
sk.vub.mobile VÚB Mobile Banking
sk.tb.emv.mobile Čítačka
sk.raiffeisen.ib.androidwrapper Raiffeisen Bank SK
cz.homecredit.hcsk Home Credit SK
com.zentity.pabk Poštová banka
hr.asseco.android.jimba.mUCI.sk SmartBanking SK
sk.mbank mBank SK
sk.primabanka.penazenka Peňaženka
com.firstdirect.bankingonthego first direct
com.revolut.revolut Revolut - Get more from your money
com.outsystemsenterprise.thinkmoneyprod.ThinkMoney thinkmoney
com.vanso.gtbankapp GTBank
com.suntrust.mobilebanking SunTrust Mobile App

Hydra.C Targets

Package Name App Name
com.netflix.mediaclient Netflix
eu.inmite.prj.kb.mobilbank Mobilni Banka
com.bitfinex.mobileapp Bitfinex
com.google.android.gm Gmail
es.lacaixa.mobile.android.newwapicon CaixaBank
co.com.bbva.mb BBVA Colombia
com.albarakaapp Albaraka Mobile Banking
com.indra.itecban.triodosbank.mobile.banki -
es.bancosantander.apps Santander
pl.ideabank.mobilebanking Idea Bank PL
pl.envelobank.aplikacja EnveloBank
net.inverline.bancosabadell.officelocator.android Banco Sabadell App. Your mobile bank
com.ambank.ambankonline AmOnline
com.liberty.jaxx Jaxx Liberty: Blockchain Wallet
com.yahoo.mobile.client.android.mail Yahoo Mail – Organized Email
pl.int.poczta INT Poczta
com.bitcoin.mwallet Bitcoin Wallet
com.cleverlance.csas.servis24 SERVIS 24 Mobilni banka
com.getingroup.mobilebanking Getin Mobile
org.electrum.electrum Electrum Bitcoin Wallet
com.magiclick.odeabank Odeabank
com.akbank.android.apps.akbank_direkt Akbank
cz.rb.app.smartphonebanking Mobilní eKonto Raiffeisenbank
com.db.pwcc.dbmobile Deutsche Bank Mobile
com.avuscapital.trading212 Trading 212 - Stocks, ETFs, Forex, Gold
softax.pekao.powerpay PeoPay
com.binance.dev Binance - Buy & Sell Bitcoin Securely
com.rsi ruralvía
com.connectivityapps.hotmail Connect for Hotmail & Outlook: Mail and Calendar
huawei.settings.pin -
com.denizbank.mobildeniz MobilDeniz
com.grupoavalav1.bancamovil AV Villas App
my.com.hsbc.hsbcmalaysia HSBC Malaysia
eu.eleader.mobilebanking.pekao Pekao24Makler
com.bcp.bank.bcp Banca Móvil BCP
com.zoluxiones.officebanking Banco Santander Perú S.A.
com.indra.itecban.mobile.novobanco NBapp Spain
es.evobanco.bancamovil EVO Banco móvil
com.rbs.mobile.android.rbs Royal Bank of Scotland Mobile Banking
samsung.settings.pin -
com.grupocajamar.wefferent Grupo Cajamar
com.samsung.android.email.provider Samsung Email
com.clairmail.fth Fifth Third Mobile Banking
com.hittechsexpertlimited.hitbtc HitBTC – Bitcoin Trading and Crypto Exchange
de.dkb.portalapp DKB-Banking
io.totalcoin.wallet Bitcoin Wallet Totalcoin - Buy and Sell Bitcoin
pe.com.interbank.mobilebanking Interbank APP
cz.fio.sb2 Fio Smartbanking CZ
es.caixaontinyent.caixaontinyentapp Caixa Ontinyent
de.fiducia.smartphone.android.banking.vr VR Banking Classic
com.polehin.android Bitcoin Wallet - Buy BTC
com.pozitron.iscep İşCep - Mobile Banking
com.cajaingenieros.android.bancamovil Caja de Ingenieros Banca MÓVIL
wit.android.bcpBankingApp.millenniumPL Bank Millennium
es.ibercaja.ibercajaapp Ibercaja
alior.bankingapp.android Usługi Bankowe
pl.interia.poczta_next Nowa Poczta Interia
com.mobillium.papara Papara
com.uphold.wallet Uphold - Trade, Invest, Send Money For Zero Fees
pl.cinkciarz Currency Exchange Conotoxia
com.nearform.ptsb permanent tsb
com.db.mm.norisbank norisbank App
com.konylabs.cbplpat Citi Handlowy
tr.com.sekerbilisim.mbank ŞEKER MOBİL ŞUBE
cz.csob.smartbanking.era Smartbanking PS
com.citi.citimobile Citi Mobile®
pl.onet.mail Onet Poczta - e-mail app
com.cooperativebank.bank The Co-operative Bank
cz.equabank.mobilebanking Equa bank
com.pttfinans PTTBank
es.univia.unicajamovil UnicajaMovil
com.garanti.cepsubesi Garanti BBVA Mobile
my.com.maybank2u.m2umobile Maybank2u MY
cz.seznam.email Email.cz
es.pibank.customers Pibank
com.coinbase.android Coinbase – Buy & Sell Bitcoin. Crypto Wallet
de.ingdiba.bankingapp ING Banking to go
com.bancodebogota.bancamovil Banco de Bogotá
com.tecnocom.cajalaboral Banca Móvil Laboral Kutxa
com.teb CEPTETEB
eu.netinfo.colpatria.system Scotiabank Colpatria
com.btcturk.pro BtcTurk PRO - Bitcoin Al-Sat
com.citibanamex.banamexmobile Citibanamex Móvil
io.cex.app.prod CEX.IO Cryptocurrency Exchange
com.plunien.poloniex Poloniex Crypto Exchange
pl.raiffeisen.nfc Mobilny Portfel
es.openbank.mobile Openbank – banca móvil
uk.co.metrobankonline.mobile.android.production Metro Bank
com.tmobtech.halkbank Halkbank Mobil
uk.co.mbna.cardservices.android MBNA - Card Services App
pl.wp.wppoczta WP Poczta
pl.ing.mojeing Moje ING mobile
com.citibank.CitibankMY Citibank MY
pl.pkobp.iko IKO
pl.wp.pocztao2 Poczta o2
com.ingbanktr.ingmobil ING Mobil
com.tdbank TD Bank (US)
om.instagram.android -
cash.klever.blockchain.wallet Klever Wallet: Buy Bitcoin, Ethereum, Tron, Crypto
com.finansbank.mobile.cepsube QNB Finansbank Mobile Banking
com.myetherwallet.mewwallet MEW wallet – Ethereum wallet
com.finanteq.finance.bgz BNP Paribas GOMobile
com.moneybookers.skrillpayments.neteller NETELLER - fast, secure and global money transfers
com.grppl.android.shell.halifax Halifax: the banking app that gives you extra
cz.mbank mBank CZ
com.grupoavaloc1.bancamovil Banco de Occidente Móvil
cz.fio.android.smartbroker Fio Smartbroker
com.todo1.mobile Bancolombia App Personas
uk.co.hsbc.hsbcukmobilebanking HSBC UK Mobile Banking
com.ubercab Uber - Request a ride
com.Bither.one Bither
com.electroneum.mobile Electroneum
com.ykb.android Yapı Kredi Mobile
com.alibaba.aliexpresshd AliExpress - Smarter Shopping, Better Living
uk.co.tescomobile.android Tesco Mobile
com.microsoft.office.outlook Microsoft Outlook: Organize Your Email & Calendar
com.amazon.mShop.android.shopping Amazon Shopping - Search, Find, Ship, and Save
pl.nestbank.nestbank Nest Bank nowy
pl.noblebank.mobile Noble Mobile
com.suntrust.mobilebanking SunTrust Mobile App
app.wizink.es WiZink, tu banco senZillo
co.bitx.android.wallet Luno: Buy Bitcoin, Ethereum and Cryptocurrency
com.grppl.android.shell.BOS Bank of Scotland Mobile Banking: secure on the go
cz.csob.ceb ČSOB CEB Mobile
com.starfinanz.smob.android.sfinanzstatus Sparkasse Ihre mobile Filiale
finansbank.enpara Enpara.com Cep Şubesi
eu.eleader.mobilebanking.invest plusbank24
es.bancosantander.empresas Santander Empresas
com.bitpay.wallet BitPay – Secure Bitcoin Wallet
com.okinc.okex.gp OKEx - Bitcoin/Crypto Trading Platform
uk.co.santander.santanderUK Santander Mobile Banking
com.comarch.mobile.banking.bgzbnpparibas.biznes Mobile BiznesPl@net
tr.gov.turkiye.edevlet.kapisi e-Devlet Kapısı
cz.csas.georgego George Česká spořitelna
com.grppl.android.shell.CMBlloydsTSB73 Lloyds Bank Mobile Banking: by your side
de.commerzbanking.mobil Commerzbank Banking - The app at your side
com.mail.mobile.android.mail mail.com mail
com.discoverfinancial.mobile Discover Mobile
de.comdirect.android comdirect mobile App
es.santander.Criptocalculadora Criptocalculadora
com.kutxabank.android Kutxabank
com.targoes_prod.bad TARGOBANK - Banca a distancia
cz.airbank.android My Air
pe.pichincha.bm APP Banco Pichincha Perú
com.bbva.netcash BBVA Net Cash: ES & PT
com.paypal.android.p2pmobile PayPal Mobile Cash: Send and Request Money Fast
com.android.vending Google Play
pl.bzwbk.bzwbk24 Santander mobile
com.bbva.bbvacontigo BBVA Spain
payumoney.merchantap -
com.comarch.security.mobilebanking ING Business
us.zoom.videomeetings ZOOM Cloud Meetings
com.bbva.nxt_peru BBVA Perú  
com.Plus500 Plus500: CFD Online Trading on Forex and Stocks
com.thanksmister.bitcoin.localtrader Local Trader for LocalBitcoins
com.ubercab.eats Uber Eats: Food Delivery
com.bancocajasocial.geolocation Banco Caja Social Móvil
es.caixagalicia.activamovil ABANCA- Banca Móvil
de.postbank.finanzassistent Postbank Finanzassistent
tsb.mobilebanking TSB Bank Mobile Banking
es.liberbank.cajasturapp Banca Digital Liberbank
com.yoox YOOX - Fashion, Design and Art
com.bitmarket.trader Aplikacja Bitmarket
mobile.santander.de Santander Mobile Banking
com.pnc.ecommerce.mobile PNC Mobile
pl.bps.bankowoscmobilna BPS Mobilnie
com.btcturk BtcTurk Bitcoin Borsası
com.bankinter.launcher Bankinter Móvil
eu.unicreditgroup.hvbapptan HVB Mobile Banking
pl.sgb.wallet PORTFEL SGB
com.bankia.wallet Bankia Wallet
com.cimbmalaysia CIMB Clicks Malaysia
com.whatsapp WhatsApp Messenger
com.konylabs.HongLeongConnect Hong Leong Connect Mobile Banking
net.bitstamp.app Bitstamp – Buy & Sell Bitcoin at Crypto Exchange
pl.aliorbank.aib Alior Mobile
com.facebook.katana Facebook
cz.csob.smartbanking ČSOB Smartbanking
com.vakifbank.mobile VakıfBank Mobil Bankacılık
com.mediolanum Banco Mediolanum España
com.kraken.trade Pro: Advanced Bitcoin & Crypto Trading
com.ally.MobileBanking Ally Mobile
pe.com.scotiabank.blpm.android.client Scotiabank Perú
pl.bph BusinessPro Lite
hr.asseco.android.jimba.mUCI.cz Smart Banking
com.cajasur.android Cajasur
com.finanteq.finance.ca CA24 Mobile
cz.moneta.smartbanka Smart Banka
es.cecabank.ealia2103appstore UniPay Unicaja
tr.com.hsbc.hsbcturkey HSBC Turkey
com.kuveytturk.mobil Kuveyt Türk
com.ebay.mobile eBay: Buy, sell, and save money on home essentials
com.ziraat.ziraatmobil Ziraat Mobile
com.targo_prod.bad TARGOBANK Mobile Banking
com.barclaycardus Barclays US
cz.kb.mba.business Mobilní banka Business
com.todo1.davivienda.mobileapp Davivienda Móvil
hr.asseco.android.jimba.mUCI.sme.cz Business Smart Banking
com.fibabanka.Fibabanka.mobile Fibabanka Mobile
com.konylabs.capitalone Capital One® Mobile
samsung.settings.pass -
www.ingdirect.nativeframe ING España. Banca Móvil
com.infonow.bofa Bank of America Mobile Banking
com.nanooqit.economiaemail Centrum.cz mail
de.sdvrz.ihb.mobile.app SpardaApp
com.mycelium.wallet Mycelium Bitcoin Wallet
es.cm.android Bankia
pl.mbank mBank PL
com.wf.wellsfargomobile Wells Fargo Mobile
exodusmovement.exodus Exodus: Crypto Bitcoin Wallet
com.cmcmarkets.android.cfd CMC: CFD Trading
com.google.android.play.games Google Play Games
com.rbs.mobile.android.natwest NatWest Mobile Banking
cz.csas.business24 BUSINESS 24 Mobilní banka
com.bbt.myfi U by BB&T
com.usaa.mobile.android.usaa USAA Mobile
piuk.blockchain.android Blockchain Wallet. Bitcoin, Bitcoin Cash, Ethereum
com.breadwallet BRD Bitcoin Wallet. Buy BTC Bitcoin Cash, Ethereum
com.engage.pbb.pbengage2my.release PB engage MY

Demo or trial?

Contact us