Group-IB found the long-running banking trojan building a second app that shelters inside Android's employer workspace.