A new family of SMS Trojans named Vidro appeared a few days ago but weve already collected a lot of APK files with very similar functionality. At the moment all the samples we have found target users only from Poland. The mechanism is very similar to the way the very first Android malware (Trojan-SMS.AndroidOS.FakePlayer) spread. Vidro is able to update the configuration file (which might contain a new premium rate number and SMS text) and update itself.”]
Source: https://securelist.com/vidro-how-deep-and-mobile-is-the-rabbit-hole/33654/