Bitso_Alpha.apk

24.52 MB

Analyzed: 2026-02-20 19:26 UTC

APK Security & Privacy Score

Security scoring uses multi-engine scan signals and APK indicators. Privacy scoring uses requested permissions and network endpoint patterns.

Security Scan-weighted
98/100
Threat scan clean Modern target SDK
Privacy Permissions & network
67/100
High-risk permissions HTTP URLs found Possible tracking
80/100
Good
Overall trust

Facts

Threat scan 0/76 flagged, 0 suspicious
Permissions 23 requested
Network strings 25 URLs (1 HTTP, 24 HTTPS)
Target SDK 35
Certificate Valid until 2043-01-31 (17 years, suspicious)

Warnings

Found 1 HTTP URL strings (unencrypted).
High-risk permissions detected: android.permission.RECEIVE_BOOT_COMPLETED
Possible analytics/tracking domains found: firebase-settings.crashlytics.com
Package Name com.bitso.alpha
Version Code 94
Version Name 1.37.0
Application Name com.bitso.alpha.AlphaApplication
Debuggable No
Allow Backup No
Min SDK Android 24 (Nougat)
Target SDK Android 35 (Android 15)
Supported ABIs
Universal

Certificate & Signer

Valid From 2018-02-06 23:46:53
Valid To 2043-01-31 23:46:53
Serial Number 58c05db2
Thumbprint 4720a8d27e80b28757c1f8b8b26c5fb84979485e
Issuer: C 52
Issuer: CN Bitso
Issuer: DN C:52, CN:Bitso, L:Mexico, O:Bitso, ST:Df, OU:Mobile
Issuer: L Mexico
Issuer: O Bitso
Issuer: OU Mobile
Issuer: ST Df
Subject: C 52
Subject: CN Bitso
Subject: DN C:52, CN:Bitso, L:Mexico, O:Bitso, ST:Df, OU:Mobile
Subject: L Mexico
Subject: O Bitso
Subject: OU Mobile
Subject: ST Df

Security Scan

0 /76
✓ Clean
Scanned by 76 security vendors
Last scan: 2026-02-01 14:00 UTC
Malicious
0
Suspicious
0
Harmless
0
Undetected
65
Timeout
0
Failure
0

Scan Providers

76 vendors
ALYac undetected
No result reported
Engine 2.0.0.10
APEX type-unsupported
No result reported
Engine 6.743
AVG undetected
No result reported
Engine 23.9.8494.0
Acronis undetected
No result reported
Engine 1.2.0.121
AhnLab-V3 undetected
No result reported
Engine 3.29.1.10604
Alibaba undetected
No result reported
Engine 0.3.0.5
Antiy-AVL undetected
No result reported
Engine 3.0
Arcabit undetected
No result reported
Engine 2025.0.0.23
Avast undetected
No result reported
Engine 23.9.8494.0
Avast-Mobile undetected
No result reported
Engine 260201-02
Avira undetected
No result reported
Engine 8.3.3.24
Baidu undetected
No result reported
Engine 1.0.0.2
BitDefender undetected
No result reported
Engine 7.2
BitDefenderFalx undetected
No result reported
Engine 2.0.936
Bkav undetected
No result reported
Engine 2.0.0.1
CAT-QuickHeal undetected
No result reported
Engine 22.00
CMC undetected
No result reported
Engine 2.4.2022.1
CTX undetected
No result reported
Engine 2024.8.29.1
ClamAV undetected
No result reported
Engine 1.5.1.0
CrowdStrike undetected
No result reported
Engine 1.0
Cylance type-unsupported
No result reported
Engine 3.0.0.0
Cynet type-unsupported
No result reported
Engine 4.0.3.4
DeepInstinct type-unsupported
No result reported
Engine 5.0.0.8
DrWeb undetected
No result reported
Engine 7.0.74.11120
ESET-NOD32 undetected
No result reported
Engine 18.2.18.0
Elastic type-unsupported
No result reported
Engine 4.0.247
Emsisoft undetected
No result reported
Engine 2024.8.0.61147
F-Secure undetected
No result reported
Engine 18.10.1547.307
Fortinet undetected
No result reported
Engine 7.0.30.0
GData undetected
No result reported
Engine GD:27.43385AVA:64.30590
Google undetected
No result reported
Engine 1769947241
Gridinsoft undetected
No result reported
Engine 1.0.237.174
Ikarus undetected
No result reported
Engine 6.4.16.0
Jiangmin undetected
No result reported
Engine 16.0.100
K7AntiVirus undetected
No result reported
Engine 14.32.58458
K7GW undetected
No result reported
Engine 14.32.58459
Kaspersky undetected
No result reported
Engine 22.0.1.28
Kingsoft undetected
No result reported
Engine None
Lionic undetected
No result reported
Engine 8.16
Malwarebytes undetected
No result reported
Engine 3.1.0.206
MaxSecure confirmed-timeout
No result reported
Engine 1.0.0.1
McAfeeD undetected
No result reported
Engine 1.2.0.13486
MicroWorld-eScan undetected
No result reported
Engine 14.0.409.0
Microsoft undetected
No result reported
Engine 1.1.25110.1
NANO-Antivirus undetected
No result reported
Engine 1.0.170.26895
Paloalto type-unsupported
No result reported
Engine 0.9.0.1003
Panda undetected
No result reported
Engine 4.6.4.2
Rising undetected
No result reported
Engine 25.0.0.28
SUPERAntiSpyware undetected
No result reported
Engine 5.6.0.1032
Sangfor undetected
No result reported
Engine 2.22.3.0
SentinelOne type-unsupported
No result reported
Engine 7.5.3.1
Skyhigh undetected
No result reported
Engine v2021.2.0+4045
Sophos undetected
No result reported
Engine 3.3.1.0
Symantec undetected
No result reported
Engine 1.22.0.0
SymantecMobileInsight undetected
No result reported
Engine 2.0
TACHYON undetected
No result reported
Engine 2026-02-01.02
Tencent undetected
No result reported
Engine 1.0.0.1
Trapmine type-unsupported
No result reported
Engine 4.0.8.0
TrellixENS undetected
No result reported
Engine 6.0.6.653
TrendMicro undetected
No result reported
Engine 24.550.0.1002
TrendMicro-HouseCall undetected
No result reported
Engine 24.550.0.1002
Trustlook undetected
No result reported
Engine 1.0
VBA32 undetected
No result reported
Engine 5.5.0
VIPRE undetected
No result reported
Engine 6.0.0.35
Varist undetected
No result reported
Engine 6.6.1.3
ViRobot undetected
No result reported
Engine 2014.3.20.0
VirIT undetected
No result reported
Engine 9.5.1135
Webroot undetected
No result reported
Engine 1.9.0.8
Xcitium undetected
No result reported
Engine 38374
Yandex undetected
No result reported
Engine 5.5.2.24
Zillya undetected
No result reported
Engine 2.0.0.5535
ZoneAlarm undetected
No result reported
Engine 6.22-112233572
Zoner undetected
No result reported
Engine 2.2.2.0
alibabacloud type-unsupported
No result reported
Engine 2.2.0
huorong undetected
No result reported
Engine 0b55108:0b55108:5a5090d:5a5090d
tehtris type-unsupported
No result reported
Engine v0.1.4

File Signatures

SHA-256 76e7f80d60f1cd69c53496d5da2d95f287f5fb7660aac897f1d5d3f4c9eae7e5
MD5 f2d07cefe217fbc4aa09416a3e247488
SHA-1 68532b07c252cce3c63b6d9a63be326031f608dc
SSDEEP 393216:sIQmTwchCvr9MNqoio3/vbEzTxvKW+RY7IAL:VTnhCvr2D3/vivKW+fi
TLSH T1D447CF03E3024D26C9BEA6355CB66751EB336E81AF0357DB1008B17C7E772D5AE98AC4
VHASH c09964511205a87ba09dfdef70b57869
PERMHASH 779e5d0712e79c02ecdc2cd8c202f434952f9968a3c4868dda56ae39b21047e1

File Intelligence

Type Description Android Human-friendly file type name based on multiple detection methods.
Type Extension apk Most likely file extension inferred from the content.
Type Tag android Primary type tag assigned by the classifier.
Type Tags executable, mobile, android, apk Additional type tags that describe the file content.
Magic Zip archive data, at least v0.0 to extract, compression method=deflate File signature result from magic bytes inspection.
Magika APK File type predicted by Magika (ML-based file type detection).
TrID Android Package (31.7%), Opera Widget (16.4%), VYM Mind Map (14.7%), Pocket Code/Catroid Catrobat Project (12.9%), Sweet Home 3D Design (generic) (12.3%) TrID file type guesses with probabilities.
dhash 0000141d1e160110 Perceptual hash used to compare visual similarity of files.
raw md5 b03716ff71450fbd0e9c6ecbe432fb54 Raw MD5 hash of the file contents.
extensions js (660), css (178), version (119), kotlin_module (9), svg (6), txt (6), md (4), properties (4), cur (2), html (2), bin (1), c (1), E (1), h (1), o (1), prof (1), profm (1), textproto (1), woff2 (1), xml (1) File extensions found inside the APK and how many of each.
file types unknown (997), HTML (1), Java Bytecode (1), XML (1) Detected embedded file types and their counts.
highest datetime 1981-01-01 01:01:02 UTC Latest timestamp found among files inside the archive.
lowest datetime 1981-01-01 01:01:02 UTC Earliest timestamp found among files inside the archive.
num children 3483 Number of files contained within the archive.
type APK Container type detected for the analyzed file.
uncompressed size 14 MB Estimated total size of all files after extraction.

Deep Manifest Analysis

Activity Intents (2)

com.bitso.alpha.MainActivity
Actions
Main Activity Action: Start as a main entry point, does not expect to android.intent.action.MAIN
View Activity Action: Display the data to the user. android.intent.action.VIEW
Categories
android.intent.category.DEFAULT android.intent.category.LAUNCHER android.intent.category.BROWSABLE
net.openid.appauth.RedirectUriReceiverActivity
Actions
View Activity Action: Display the data to the user. android.intent.action.VIEW
Categories
android.intent.category.DEFAULT android.intent.category.BROWSABLE

Service Intents (2)

com.clevertap.android.sdk.pushnotification.fcm.FcmMessageListenerService
Actions
Firebase messaging event Action used by Firebase to deliver a push message to the app. com.google.firebase.MESSAGING_EVENT
Firebase messaging service Handles push notifications and data messages from Firebase Cloud Messaging. com.google.firebase.messaging.FirebaseMessagingService
Actions
Firebase messaging event Action used by Firebase to deliver a push message to the app. com.google.firebase.MESSAGING_EVENT

Receiver Intents (11)

Profile installer Installs performance profiles to speed up app startup and hot paths. androidx.profileinstaller.ProfileInstallReceiver
Actions
Install performance profile Installs a profile that helps optimize app performance. androidx.profileinstaller.action.INSTALL_PROFILE
Skip profile install Skips profile installation for this build. androidx.profileinstaller.action.SKIP_FILE
Save performance profile Saves a profile generated during app usage. androidx.profileinstaller.action.SAVE_PROFILE
Benchmark operation Runs a profile installer benchmark operation. androidx.profileinstaller.action.BENCHMARK_OPERATION
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
Actions
Power Connected Broadcast Action: External power has been connected to the device. android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED android.intent.action.ACTION_POWER_DISCONNECTED
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
Actions
Battery Okay Broadcast Action: Indicates the battery is now okay after being low. android.intent.action.BATTERY_OKAY
Battery Low Broadcast Action: Indicates low battery condition on the device. android.intent.action.BATTERY_LOW
androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
Actions
android.net.conn.CONNECTIVITY_CHANGE android.net.conn.CONNECTIVITY_CHANGE
androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
Actions
Device Storage Low Broadcast Action: A sticky broadcast that indicates low memory android.intent.action.DEVICE_STORAGE_LOW
Device Storage Ok Broadcast Action: Indicates low memory condition on the device no longer exists android.intent.action.DEVICE_STORAGE_OK
androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
Actions
androidx.work.impl.background.systemalarm.UpdateProxies androidx.work.impl.background.systemalarm.UpdateProxies
Work rescheduler Reschedules background work after reboot or app update. androidx.work.impl.background.systemalarm.RescheduleReceiver
Actions
Boot Completed Broadcast Action: This is broadcast once, after the system has finished android.intent.action.BOOT_COMPLETED
Time Changed Broadcast Action: The time was set. android.intent.action.TIME_SET
Timezone Changed Broadcast Action: The timezone has changed. android.intent.action.TIMEZONE_CHANGED
androidx.work.impl.diagnostics.DiagnosticsReceiver
Actions
androidx.work.diagnostics.REQUEST_DIAGNOSTICS androidx.work.diagnostics.REQUEST_DIAGNOSTICS
com.clevertap.android.sdk.pushnotification.fcm.CTFirebaseMessagingReceiver
Actions
com.google.android.c2dm.intent.RECEIVE com.google.android.c2dm.intent.RECEIVE
com.google.firebase.iid.FirebaseInstanceIdReceiver
Actions
com.google.android.c2dm.intent.RECEIVE com.google.android.c2dm.intent.RECEIVE
zendesk.support.DeepLinkingBroadcastReceiver
Actions
zendesk.support zendesk.support

Requested Permissions (23)

have full network access Allows the app to create network sockets and use custom network protocols. The browser and other applications provide means to send data to the internet, so this permission is not required to send data to the internet. android.permission.INTERNET
view network connections Allows the app to view information about network connections such as which networks exist and are connected. android.permission.ACCESS_NETWORK_STATE
view Wi-Fi connections Allows the app to view information about Wi-Fi networking, such as whether Wi-Fi is enabled and name of connected Wi-Fi devices. android.permission.ACCESS_WIFI_STATE
control vibration Allows the app to control the vibrator. android.permission.VIBRATE
com.google.android.gms.permission.AD_ID Custom app or vendor permission (not publicly documented). com.google.android.gms.permission.AD_ID
android.permission.POST_NOTIFICATIONS Custom app or vendor permission (not publicly documented). android.permission.POST_NOTIFICATIONS
take pictures and videos This app can take pictures and record videos using the camera while the app is in use. android.permission.CAMERA
access approximate location only in the foreground This app can get your approximate location from location services while the app is in use. Location services for your device must be turned on for the app to get location. android.permission.ACCESS_COARSE_LOCATION
access precise location only in the foreground This app can get your precise location from location services while the app is in use. Location services for your device must be turned on for the app to get location. This may increase battery usage. android.permission.ACCESS_FINE_LOCATION
android.permission.USE_BIOMETRIC Custom app or vendor permission (not publicly documented). android.permission.USE_BIOMETRIC
android.permission.USE_FINGERPRINT Custom app or vendor permission (not publicly documented). android.permission.USE_FINGERPRINT
android.permission.DOWNLOAD_WITHOUT_NOTIFICATION Custom app or vendor permission (not publicly documented). android.permission.DOWNLOAD_WITHOUT_NOTIFICATION
read the contents of your shared storage Allows the app to read the contents of your shared storage. android.permission.READ_EXTERNAL_STORAGE
modify or delete the contents of your shared storage Allows the app to write the contents of your shared storage. android.permission.WRITE_EXTERNAL_STORAGE
keep car screen turned on Allows the app to keep the car screen turned on. android.permission.WAKE_LOCK
Cloud messaging receive Allows the app to receive push messages via Google/Firebase Cloud Messaging. com.google.android.c2dm.permission.RECEIVE
Install Referrer service Allows Google Play to bind to the app's Install Referrer service for install attribution. com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
AdServices Attribution Required to call AdServices Attribution APIs. android.permission.ACCESS_ADSERVICES_ATTRIBUTION
AdServices Advertising ID Required to call AdServices Advertising ID APIs. android.permission.ACCESS_ADSERVICES_AD_ID
com.google.android.providers.gsf.permission.READ_GSERVICES Custom app or vendor permission (not publicly documented). com.google.android.providers.gsf.permission.READ_GSERVICES
run at startup Allows the app to have itself started as soon as the system has finished booting. This can make it take longer to start the tablet and allow the app to slow down the overall tablet by always running. android.permission.RECEIVE_BOOT_COMPLETED
Foreground service Allows the app to run a foreground service. android.permission.FOREGROUND_SERVICE
Dynamic receiver access Internal app permission used to protect dynamic broadcast receivers. com.bitso.alpha.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Uses Features (6)

Camera Feature for {@link #getSystemAvailableFeatures} and android.hardware.camera
Camera Autofocus Feature for {@link #getSystemAvailableFeatures} and android.hardware.camera.autofocus
Camera Flash Feature for {@link #getSystemAvailableFeatures} and android.hardware.camera.flash
Camera Front Feature for {@link #getSystemAvailableFeatures} and android.hardware.camera.front
Screen Landscape Feature for {@link #getSystemAvailableFeatures} and android.hardware.screen.landscape
Wifi Feature for {@link #getSystemAvailableFeatures} and android.hardware.wifi

Activities (46)

com.bitso.alpha.MainActivity
com.bitso.alpha.orders.create.presentation.OrderActivity
com.bitso.alpha.markets.detail.presentation.MarketActivity
com.bitso.alpha.authentication.login.presentation.LoginActivity
com.bitso.alpha.authentication.mobilepin.enterpin.EnterMobilePinActivity
com.bitso.alpha.apprecall.presentation.blocking.AppRecallBlockingActionActivity
com.bitso.alpha.settings.notifications.core.presentation.NotificationsSettingsActivity
com.bitso.alpha.fees.presentation.FeesActivity
com.bitso.alpha.markets.selector.presentation.MarketSelectorActivity
com.bitso.alpha.account.presentation.AccountActivity
com.bitso.alpha.settings.presentation.trading.TradingSettingsActivity
zendesk.support.guide.HelpCenterActivity
zendesk.support.guide.ViewArticleActivity
zendesk.support.request.RequestActivity
zendesk.support.requestlist.RequestListActivity
com.bitso.android.customer_support.helpcenter.presentation.CustomHelpCenterActivity
com.bitso.android.customer_support.chat.presentation.CustomerSupportChatActivity
zendesk.classic.messaging.MessagingActivity
com.bitso.android.hardstop.transaction.presentation.deniedScreen.TransactionHardstopDeniedScreenActivity
com.bitso.android.hardstop.transaction.presentation.manualReviewScreen.TransactionHardstopInManualReviewScreenActivity
com.bitso.android.hardstop.transaction.presentation.cancelTransactionScreen.TransactionHardstopCancelTransactionScreenActivity
com.bitso.android.mobile_pin.common.presentation.MobilePinActivity
com.bitso.android.oneTimePassword.presentation.OtpActivity
com.bitso.android.accountDeletion.presentation.AccountDeletionActivity
com.bitso.android.transaction.history.presentation.detail.TransactionDetailActivity
com.bitso.android.authProcess.presentation.AuthProcessActivity
com.bitso.android.userLogout.presentation.LogoutActivity
com.bitso.android.biometrics.presentation.changeInBiometricsRegistry.ChangeInBiometricsRegistryActivity
com.bitso.android.biometrics.presentation.activation.BiometricsActivationActivity
com.bitso.android.ui.compose.webview.WebViewActivity
com.bitso.android.apprecall.presentation.AppRecallActivity
com.bitso.android.rootedDeviceCheck.presentation.RootedDeviceActivity
com.bitso.android.permissions.presentation.PermissionRequestActivity
com.bitso.android.authCore.presentation.auth.AuthActivity
com.bitso.android.authCore.presentation.endSession.EndSessionActivity
net.openid.appauth.RedirectUriReceiverActivity
zendesk.messaging.android.internal.messagingscreen.MessagingActivity
zendesk.messaging.android.internal.conversationscreen.ImageViewerActivity
com.clevertap.android.sdk.InAppNotificationActivity
com.clevertap.android.sdk.inbox.CTInboxActivity
net.openid.appauth.AuthorizationManagementActivity
com.google.android.gms.auth.api.signin.internal.SignInHubActivity
com.google.android.gms.common.api.GoogleApiActivity
androidx.activity.ComponentActivity
com.journeyapps.barcodescanner.CaptureActivity
com.google.android.play.core.common.PlayCoreDialogWrapperActivity

Services (13)

com.clevertap.android.sdk.pushnotification.fcm.FcmMessageListenerService
com.google.firebase.components.ComponentDiscoveryService
Firebase messaging service Handles push notifications and data messages from Firebase Cloud Messaging. com.google.firebase.messaging.FirebaseMessagingService
com.google.android.gms.measurement.AppMeasurementService
com.google.android.gms.measurement.AppMeasurementJobService
com.google.android.gms.auth.api.signin.RevocationBoundService
com.google.firebase.sessions.SessionLifecycleService
androidx.work.impl.background.systemalarm.SystemAlarmService
androidx.work.impl.background.systemjob.SystemJobService
androidx.work.impl.foreground.SystemForegroundService
androidx.room.MultiInstanceInvalidationService
com.google.android.datatransport.runtime.backends.TransportBackendDiscovery
com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

Broadcast Receivers (15)

zendesk.support.DeepLinkingBroadcastReceiver zendesk.support.DeepLinkingBroadcastReceiver
com.clevertap.android.sdk.pushnotification.CTPushNotificationReceiver com.clevertap.android.sdk.pushnotification.CTPushNotificationReceiver
com.clevertap.android.sdk.pushnotification.fcm.CTFirebaseMessagingReceiver com.clevertap.android.sdk.pushnotification.fcm.CTFirebaseMessagingReceiver
com.google.firebase.iid.FirebaseInstanceIdReceiver com.google.firebase.iid.FirebaseInstanceIdReceiver
com.google.android.gms.measurement.AppMeasurementReceiver com.google.android.gms.measurement.AppMeasurementReceiver
androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
Work rescheduler Reschedules background work after reboot or app update. androidx.work.impl.background.systemalarm.RescheduleReceiver
androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
androidx.work.impl.diagnostics.DiagnosticsReceiver androidx.work.impl.diagnostics.DiagnosticsReceiver
Profile installer Installs performance profiles to speed up app startup and hot paths. androidx.profileinstaller.ProfileInstallReceiver
com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

Content Providers (9)

com.bitso.android.file.provider.GenericFileProvider
com.bitso.android.firebase.initializer.provider.FirebaseInitializerContentProvider
com.bitso.android.mobileMetrics.provider.MobileMetricsContentProvider
zendesk.support.SupportSdkStartupProvider
zendesk.messaging.android.internal.ZendeskFileProvider
zendesk.support.guide.GuideSdkStartupProvider
androidx.startup.InitializationProvider
zendesk.core.MediaFileProvider
com.squareup.picasso.PicassoProvider

URL Endpoints (30)

Submission Details

Submitted At 2026-02-20
First Submission 2026-02-20
Last Submission 2026-02-20
Stored Until 2026-03-22