Mobile malware is after the same thing as regular malware it's just on a different platform.
We use our phones to do everything from email, banking, social media, etc. Security tokens are stored in these devices for all kinds of different applications, and possibly web-sites. The average user doesn't take mobile security seriously. Try 3333
or 6666
on a friend's iPhone some time.
Access to email can give more than enough information to start taking over accounts, and could lead to identity theft. Even if they're not after your identity they can still just be the annoying malicious malware. Ransom-ware is becoming popular on Android. Maybe they just want to spam a bunch of ads through your apps.
Nowadays you need to treat your phone like you would your laptop/desktop because they've now become equivalent.