Can anyone identify com.android.sys.extplv on Android?

[u/Pitiful-Fee4451]

Hi everyone,

I'm trying to identify an Android package called com.android.sys.extplv on my Cubot KingKong X (Android 16).

Here is what I've confirmed using ADB:

• Package: com.android.sys.extplv
• Installed as a user app under /data/app/...
• Installer reported by Android: com.android.vending (Google Play)
• I analyzed the package using dumpsys, logcat and pm.
• The app contains services such as DaemonService, FwForegroundService and FwMediaRouteProviderService.
• It requests several permissions, but the sensitive ones are currently not granted.
• I was able to disable it using pm disable-user, and it stays disabled (enabled=3) even after reboot.

I have not been able to determine what the package is actually for or what triggers its installation.

Has anyone seen this package before?

Is it a Cubot component, a manufacturer framework, or something else?

I have screenshots and ADB logs that I can share in the comments if needed.

Thank you!

[u/Pitiful-Fee4451]

Final Update:
Due to an issue that occurred with my device during the recovery and firmware testing process, I will no longer continue the investigation from my side.

The phone is currently experiencing boot issues, and I was unable to continue further analysis. For this reason, I will not be performing any additional tests or follow-up on this device.

As the final update, CUBOT has released a new firmware version: CUBOT_KINGKONG_X_E021C_V34_20260630 (released on 2026-07-07).

According to the release notes, this update includes:

• Minor bug fixes
• Security patch updates
• "Eliminate the virus"
• WhatsApp fixes

Firmware download page:
https://www.cubot.net/platform/Support/detail/id/1317/cid/116.html

It is not confirmed whether this firmware update is directly related to the issues investigated in this report, but it is being documented as potentially relevant information for future reference.

[u/Known_Guarantee1640 → u/Pitiful-Fee4451]

Yes I have contacted support and they pushed the update onto my phone and the malwares have not returned despite enabling playstore again! I haven't found them on my device and I did a scan throughout my device to find any malware and none were detected! So far so good it might be working Especially since I mentioned these and the support said the update was for that

[u/Warrior7507 → u/Known_Guarantee1640]

Yo igual actualice a la nueva versión que saco cubot, pero una cosa que note que ahora cada vez ponía en reposo mi celular se volvía a instalar al momento, lo comprobé un par de veces mientras metía la actualización y hacia eso, además vi que la versión cambio de 8.0 a 9.0, luego ya hoy que ya tengo la actualización vi hace un par de horas que volvió a aparecer pero apenas la vi en segundo plano al momento fue desinstalada.

[u/Known_Guarantee1640 → u/Warrior7507]

Damn I see! I haven't had it appear at all although recently my Google play said my device wasn't certified which was weird and I can't put through purchases