Aside from providing legitimate screen recording functionality, the malicious iRecorder can record surrounding audio from the device’s microphone and upload it to the attacker’s command and control (C&C) server.

Source: https://www.canindia.com/android-recording-app-with-50k-installs-stole-microphone-recordings-files/