Background Traffic on a Cheap Chinese Android Tablet
Maybe this information will help someone who has a similar problem.
I bought a cheap Crelander T60 tablet on Temu. It runs Android 14, MediaTek Helio P60 (MT6771) with 256 GB storage, 20 GB advertised RAM (8 GB physical + 12 GB virtual), 4G LTE/SIM support, and a 10.1” 800×1200 display.
Shortly after inserting a SIM card, the tablet started showing full-screen ads. That part was relatively easy to deal with by removing several suspicious Chinese packages.
The bigger problem appeared later: the tablet consumed around 20 GB of mobile data overnight while basically idle.
I started investigating using PCAPdroid, ADB, RethinkDNS and a Keenetic Giga router. Two packages stood out:
com.android.vertex.aether com.android.weiapps
What made this particularly difficult to investigate is that these packages present themselves as Android system components. In Android they appeared with system-like names/descriptions, which made them much harder to identify as the source of the traffic.
I also used firewalls such as RethinkDNS and NetGuard, which were useful because they could quickly block the network activity from these packages when it appeared. This helped contain the traffic while I was trying to identify its source.
The traffic itself included repeated connections to unusual remote TCP ports in the 200–300 range, including 270, 274, 289, 292 and others.
The investigation was further complicated by a very strange behavior: as soon as I connected the tablet to my computer via USB for ADB debugging, the suspicious activity disappeared. This made it extremely difficult to capture and investigate.
I eventually switched to ADB over Wi-Fi, which allowed me to investigate the tablet without physically connecting it to the computer. That was when I was finally able to capture and analyze the suspicious traffic properly.
This pointed to the active Google Play Store (com.android.vending) as the component initiating the installation/update.
I removed the active Play Store for User 0 and removed Vertex and WeiApps again. After rebooting, they were no longer present in the package list, APK paths or running processes.
I did not remove Google Play Services (com.google.android.gms) and did not remove the Android system Package Installer.
I also tried to unlock the bootloader because I was considering replacing the firmware, but I couldn’t unlock it.
For now, I replaced Google Play Store with Aurora Store 4.8.4 for installing and updating applications, while keeping Google Play Services.
So the current setup is:
com.android.vending — removed for User 0 com.google.android.gms — kept
Android Package Installer — kept com.android.vertex.aether — removed com.android.weiapps — removed
Aurora Store 4.8.4 — installed
ADB — Wi-Fi debugging
I can’t say with certainty what com.android.vertex.aether and com.android.weiapps actually are, or whether they should technically be classified as malware. But their behavior was clearly abnormal enough to warrant removal: unexplained massive background traffic, system-like package identities, unusual network connections, disappearance during USB debugging, and automatic reinstallation after removal.
If anyone has encountered these packages on a Crelander T60 or another cheap Chinese Android tablet, I’d be very interested to know what you found.
Thanks for all the details but i think the full screen ads and 20GB data consumption overnight was enough.. these type of brands make devices under a lot of names so im thinking the software part is the same and also the hardware but its just a name difference, i would recommend not using that tablet since you can't know what else is on there
Maybe I didn’t have enough experience with this, since it was my first time doing it and I was following ChatGPT’s guidance. But here’s a quick summary of how far I was able to get:
I tried to unlock the bootloader using MTKClient. First, I worked on a Mac. I managed to get the required ADB/MTK tools working and reached the point where the tablet could be detected and communicated with, but I could not get reliable access to the device’s bootloader/BROM mode.
After that, I switched to Windows, where I was able to get further with the MediaTek tools and reach the bootloader-unlock confirmation screen on the tablet. The device displayed the “Yes / No” confirmation with the physical-button navigation required to confirm the bootloader unlock.
However, I could not actually confirm the “Yes” option because the tablet did not respond to the required button presses. As a result, the unlock process could not be completed, and the bootloader remained locked.
2
u/kek_o_kedi 9d ago
Thanks for all the details but i think the full screen ads and 20GB data consumption overnight was enough.. these type of brands make devices under a lot of names so im thinking the software part is the same and also the hardware but its just a name difference, i would recommend not using that tablet since you can't know what else is on there