1. A method performed by a processor, wherein the method comprises: obtaining features of an Application Under Check (AUC); matching the AUC with a host application, wherein the host application is matched from a repository of applications that are a-priori known to be legitimate applications, wherein said matching comprises comparing the features of the AUC with sets of features of applications to determine the host application of the AUC; determining an identical portion of the AUC and a remainder portion of the AUC, wherein the identical portion is identical to a corresponding portion in the host application, wherein the remainder portion of the AUC is not identically included in the host application; analyzing the remainder portion to detect different functionality between the AUC and the host application; in response to said matching, determining that the AUC is a mutated application of the host application, wherein the mutated application is a variation of the host application, wherein the mutated application is a non-legitimate application, wherein said determining comprises comparing a signature of the AUC with a signature of the host application; and in response to said determining that the AUC is a mutated application, performing a predetermined action.