Malware called Gunpoder is masquerading as Nintendo games emulators. Malware is packaged with an adware library called Airpush. It can do a variety of invasive actions, including sending itself to other people over SMS. The malware is programmed to not send itself by SMS to other numbers in a phone’s contact list if the user is in China. Users get to pay for that data-stealing capability by buying a lifetime license for the app for US$0.20 or $0.49.”]
Source: https://www.csoonline.com/article/2945205/android-malware-masquerades-as-nintendo-game-emulator.html