A Trojan for Android that is installed on the device by Android.GPLoader.2.origin under the guise of a multimedia codec that is allegedly necessary for a video player correct operation. At that, during the installation of Android.GPLoader.1.origin, the name of the application—Android System—is displayed on the home screen.
Once launched, Android.GPLoader.1.origin prompts the user to grant it access to Accessibility Service.
Then the malware connects to the server and receives a list of applications to install. When the device goes to sleep mode, and its home screen is off, the Trojan opens Google Play and automatically downloads all the programs from the list. In some cases, Android.GPLoader.1.origin performs installations without waiting until the home screen is off, and it can even offer the user to install applications by themselves.