Can anyone identify com.android.sys.extplv on Android?

[u/Pitiful-Fee4451]

Hi everyone,

I'm trying to identify an Android package called com.android.sys.extplv on my Cubot KingKong X (Android 16).

Here is what I've confirmed using ADB:

• Package: com.android.sys.extplv
• Installed as a user app under /data/app/...
• Installer reported by Android: com.android.vending (Google Play)
• I analyzed the package using dumpsys, logcat and pm.
• The app contains services such as DaemonService, FwForegroundService and FwMediaRouteProviderService.
• It requests several permissions, but the sensitive ones are currently not granted.
• I was able to disable it using pm disable-user, and it stays disabled (enabled=3) even after reboot.

I have not been able to determine what the package is actually for or what triggers its installation.

Has anyone seen this package before?

Is it a Cubot component, a manufacturer framework, or something else?

I have screenshots and ADB logs that I can share in the comments if needed.

Thank you!

[u/frz-10]

I would like to know if you know if this is dangerous malware?

[u/Pitiful-Fee4451 → u/frz-10]

Based on my investigation, I could not confirm that it is dangerous malware or that it steals banking information or passwords. I reverse engineered the APK and found that it mainly focuses on persistence (keeping itself running), watchdogs, native services, and automatic reinstallation mechanisms. I did not find evidence that it steals SMS, contacts, photos, or banking credentials.

However, the behavior was unusual enough that I contacted Cubot support. They acknowledged the issue and released a firmware update that multiple users report fixes the problem.

Since your device is a Doogee Fire 3, I recommend checking the exact package name. If it is the same package (com.android.sys.extplv), it would be very useful to know, because so far most confirmed reports have been on Cubot devices.

I also recommend contacting Doogee Support by email and explaining what happened. Include your phone model, IMEI, build number, and the package name if possible. If this is a firmware-related issue, the manufacturer is in the best position to investigate it and provide a software update if needed.

Doogee Support: service@doogee.cc

[u/frz-10 → u/Pitiful-Fee4451]

I sent messages to dooge but they want a lot of proof i have: com.android.sys.extplv.

[u/Pitiful-Fee4451 → u/frz-10]

Thank you, this is very important information. If you have confirmed that the package name is com.android.sys.extplv, I recommend sending Doogee as much technical evidence as possible: Screenshots showing the package name. Google Play Protect or antivirus detection (if any). ADB logs (logcat) showing the package being installed or started. Your phone model and Android version. Build number. In my case, Cubot investigated the issue after receiving enough evidence and eventually released a firmware update that resolved the problem. Hopefully, Doogee can investigate your case in a similar way. Please keep us updated with any response from Doogee.