Malware is related to the Ztorg Trojans, but not a rooting malware but a Trojan-SMS that can send Premium rate SMS and delete incoming SMS. The first malicious app, called Magic browser was uploaded to Google Play on May 15, 2017 and was. installed more than 50,000 times. The Trojan will wait for 10 minutes before connecting to its command and control (C&C) server. It uses an interesting technique to get commands from the C&C. Using these digits, the cybercriminals can identify the country and mobile operator of the infected user. They need this to choose which premium rate SMS should be sent.”]
Source: https://securelist.com/ztorg-from-rooting-to-sms/78775/