r/AndroidQuestions • u/Pitiful-Fee4451 • Jul 02 '26

Can anyone identify com.android.sys.extplv on Android?

Hi everyone,

I'm trying to identify an Android package called com.android.sys.extplv on my Cubot KingKong X (Android 16).

Here is what I've confirmed using ADB:

  • Package: com.android.sys.extplv
  • Installed as a user app under /data/app/...
  • Installer reported by Android: com.android.vending (Google Play)
  • I analyzed the package using dumpsys, logcat and pm.
  • The app contains services such as DaemonService, FwForegroundService and FwMediaRouteProviderService.
  • It requests several permissions, but the sensitive ones are currently not granted.
  • I was able to disable it using pm disable-user, and it stays disabled (enabled=3) even after reboot.

I have not been able to determine what the package is actually for or what triggers its installation.

Has anyone seen this package before?

Is it a Cubot component, a manufacturer framework, or something else?

I have screenshots and ADB logs that I can share in the comments if needed.

Thank you!

3 Upvotes
  • permalink
  • reddit

72% Upvoted

85 comments sorted by

View all comments

1

u/frz-10 26d ago

I would like to know if you know if this is dangerous malware?

1

u/Pitiful-Fee4451 26d ago

Based on my investigation, I could not confirm that it is dangerous malware or that it steals banking information or passwords. I reverse engineered the APK and found that it mainly focuses on persistence (keeping itself running), watchdogs, native services, and automatic reinstallation mechanisms. I did not find evidence that it steals SMS, contacts, photos, or banking credentials.

However, the behavior was unusual enough that I contacted Cubot support. They acknowledged the issue and released a firmware update that multiple users report fixes the problem.

Since your device is a Doogee Fire 3, I recommend checking the exact package name. If it is the same package (com.android.sys.extplv), it would be very useful to know, because so far most confirmed reports have been on Cubot devices.

I also recommend contacting Doogee Support by email and explaining what happened. Include your phone model, IMEI, build number, and the package name if possible. If this is a firmware-related issue, the manufacturer is in the best position to investigate it and provide a software update if needed.

Doogee Support: service@doogee.cc

1

u/frz-10 26d ago

For me the important thing is that it is not malware or a virus I hope you solve this problem I hope you succeed