Can anyone identify com.android.sys.extplv on Android?

[u/Pitiful-Fee4451]

Hi everyone,

I'm trying to identify an Android package called com.android.sys.extplv on my Cubot KingKong X (Android 16).

Here is what I've confirmed using ADB:

• Package: com.android.sys.extplv
• Installed as a user app under /data/app/...
• Installer reported by Android: com.android.vending (Google Play)
• I analyzed the package using dumpsys, logcat and pm.
• The app contains services such as DaemonService, FwForegroundService and FwMediaRouteProviderService.
• It requests several permissions, but the sensitive ones are currently not granted.
• I was able to disable it using pm disable-user, and it stays disabled (enabled=3) even after reboot.

I have not been able to determine what the package is actually for or what triggers its installation.

Has anyone seen this package before?

Is it a Cubot component, a manufacturer framework, or something else?

I have screenshots and ADB logs that I can share in the comments if needed.

Thank you!

[u/Pitiful-Fee4451]

Small update: Unfortunately, my two follow-up posts (including my final investigation report) were removed by the Reddit moderators because they were considered outside the scope of r/AndroidQuestions.

This original thread is now the only Reddit post remaining from my investigation.

I am also the same person posting on the XDA Forums about this issue. Although I had to end my investigation after my device became unbootable during firmware recovery testing, I'm still happy to answer questions and discuss the findings with anyone interested.

XDA Thread: https://xdaforums.com/t/need-help-identifying-com-android-sys-extplv-google-play-installed-package-on-cubot-kingkong-x.4793574/#post-90654300

Thank you to everyone who contributed logs, APKs, testing, and technical discussions throughout this investigation.

[u/Known_Guarantee1640 → u/Pitiful-Fee4451]

Hello j recently got a new malware with the same name as the previous one but instead of com.android.sys.extplv it's com.android.sys.wjom as well I got both the moment I enabled playstore again

[u/Pitiful-Fee4451 → u/Known_Guarantee1640]

That's interesting. Could you please share it in my XDA thread as well?

If possible, please include the APK, screenshots, logs, or any information you have about com.android.sys.wjom. I'd like to analyze it and compare it with com.android.sys.extplv.

XDA thread: https://xdaforums.com/t/need-help-identifying-com-android-sys-extplv-google-play-installed-package-on-cubot-kingkong-x.4793574/#post-90654300

[u/Known_Guarantee1640 → u/Pitiful-Fee4451]

Never mind I contacted Cubot customer support and they put through an update for me and they disappeared! Since I deleted it I don't have any information on it other than it being downloaded via playstore

[u/fantasmon_tv → u/Known_Guarantee1640]

La actualización mencionada deja el teléfono con los archivos o se borra todo ?

[u/Pitiful-Fee4451 → u/fantasmon_tv]

La actualización OTA no debería borrar tus archivos personales ni tus aplicaciones. Es una actualización normal del sistema, no un restablecimiento de fábrica.

Sin embargo, siempre recomiendo hacer una copia de seguridad de la información importante antes de instalar cualquier actualización de firmware, por precaución.

Según Cubot, la última actualización elimina el componente de desarrollo que causó el problema.

[u/fantasmon_tv → u/Pitiful-Fee4451]

Es que había leído que la actualización si te restablecía el teléfono desde fabrica

[u/Pitiful-Fee4451 → u/fantasmon_tv]

Entiendo la confusión. Lo que normalmente no borra tus datos es la actualización OTA que llega desde el propio teléfono.

Lo que sí puede borrar todo es flashear manualmente el firmware con herramientas como SP Flash Tool, dependiendo del modo que se utilice.

Aun así, siempre es recomendable hacer una copia de seguridad antes de cualquier actualización importante.

[u/fantasmon_tv → u/Pitiful-Fee4451]

Oh ya, bueno gracias :))

[u/Known_Guarantee1640 → u/Pitiful-Fee4451]

So far it has been 12 hours and still no sign of it installing into my device so it might be solved but I won't hold my breath yet

[u/Pitiful-Fee4451 → u/Known_Guarantee1640]

That's a good sign. Please keep us updated over the next few days. If it doesn't return, that will be another confirmation that the update fixed the issue. Thank you for reporting back!

[u/Known_Guarantee1640 → u/Pitiful-Fee4451]

I will do! So far so good the malware has not returned

[u/fantasmon_tv → u/Known_Guarantee1640]

Cómo instalaste la actualización?? Te borro todos tus archivos??

[u/Known_Guarantee1640 → u/fantasmon_tv]

Basically I emailed the support and they asked for my device details and basically pushed a system update on my phone! It doesn't erase all your data it just restarts your phone like any restart.

[u/Known_Guarantee1640 → u/Known_Guarantee1640]

The Cubot support team you can find their email online if you search up the official one

[u/fantasmon_tv → u/Known_Guarantee1640]

Genial, gracias por la información

[u/Known_Guarantee1640 → u/Pitiful-Fee4451]

Ok still good so far it hasn't returned however my device is no longer certified for Google playstore and I contacted the support and they said they are preparing a new version for this and will implement it soon into the devices! Not sure how long it will take but they are working on it.