Malicious application dubbed as Android.Downloader.558.origin is part of special SDK package named Excelliance. Trojan connects to C&C server to download all its dependencies and additional components it also downloads separate APK, DEX and ELF files and these files can be launched without user intention. If it has root access to phone it can process the installation silently. By having complete control over the device attacker can install any third party applications, advertising modules are any other. Trojan is still available in play store.”]
Source: https://gbhackers.com/trojan-embedded-game-blazblue-downloaded-million-android-users-playstore/