The infection begins when a user installs a Gooligan-infected app on a vulnerable Android device. Gooligan then downloads a rootkit from the C&C server that takes advantage of multiple Android 4 and 5 exploits including the well-known VROOT (CVE-2013-6282) and Towelroot (CVE-2014-3153). * Steal a user’s Google email account and authentication token information * Install apps from Google Play and rate them to raise their reputation * Install adware to generate revenue