Malware known as Trojan-Banker.AndroidOS.a or Tordow can steal almost any file on an infected device by achieving superuser rights. Malware authors have long been using fake applications to disseminate their programs. Tordow is an ominous harbinger of things to come, says Kaspersky Lab researcher Anton Kivva. As their capabilities improve, so too does their software, as their software does so, so does the capabilities of their software.”]
Source: https://grahamcluley.com/file-grabs-android-banking-trojan-attacks/