Покемоны: паранойя на ровном месте

В отличие от абстрактных жителей интернета в вашем лице, огульно обвиняющих в паранойи, я потрудился и прогнал андроид-версию через Mobile Threat Prevention лидера в индустрии песочниц и могу совершёно чётко констатировать, что перед нами троянский конь.

Threat Profile
Modifies contacts
The app creates or modifies contact information. This could be used
for phishing attacks.

Reads audio and/or video
The app records data using the phone's camera and/or microphone.

Reads contacts
The app reads information about the user's contacts, such as their
names, addresses, and phone numbers. This information is
potentially sensitive, and could be used to inform spear-phishing
attacks.

Reads list of running apps
The app reads the list of apps currently running on the phone.

Loads Java class at run-time
The app dynamically loads Java code. This can be used to add or
modify behavior of the application after it is deployed, without
requiring the user to update the application. This can add flexibility,
but introduces the possibility of malicious or unwanted code to be
injected into the application at some unknown point in the future.

The app accesses files on the SD card. 
Files stored on the SD card
are not isolated between applications, allowing other apps to read or
tamper with the data. They can also be a stepping stone for attacks
on other devices the SD card read from.

Requests risky permission
The app requests one or more permissions that are classified as risky
by Google and therefore require user confirmation before app
installation.

Reads location
The app reads the device's current location.

Binds JavaScript interface
The app installs a JavaScript binding for a component implemented
as a WebView, a browser widget running as part of the application.
This permits code loaded into this WebView to call into and invoke
application code. Prior to a recent fix, vulnerabilities in this feature
caused any creation of a JavaScript interface to effectively grant
implicit access to all of the app's code, not just the methods explicitly
exposed by the JavaScript binding interface.

Broadcast receiver with no permissions
The app registers components without expecting permissions for the
sender of intents received. This may lead to possible data injection.

Sends data using implicit intent
The app sends intents that may be intercepted by unintended
recipients. The intents contain data from the application that can be
read by the recipient. Furthermore, no permissions are expected of
the recipients.

Reads device identifier
The app reads a global identifier of the device. These can be used to
track users or to spoof the device.

Loads native library at run-time
The app dynamically loads native code. This can be used to add or
modify behavior of the application after it is deployed, without
requiring the user to update the application. This can add flexibility,
but introduces the possibility of malicious or unwanted code to be
injected into the application at some unknown point in the future.

Executes shell commands
The app executes a process using the system shell.

Modifies sensitive data
The app modifies various types of sensitive data.

Contains embedded ELF file
The app includes a native ELF file. This is common for apps that
make use of native code.