TrendLabs: Malicious Optimizer and Utility Android Apps on Google Play Communicate with Trojans that Install Malware, Perform Mobile Ad Fraud

Figure 2. A graphic representation of the relationships between the malicious ad configuration servers based on data obtained from VirusTotal

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/malicious-apps-on-google-play-communicate-with-trojans-install-malware-perform-mobile-ad-fraud/