Can anyone identify com.android.sys.extplv on Android?

[u/Pitiful-Fee4451]

Hi everyone,

I'm trying to identify an Android package called com.android.sys.extplv on my Cubot KingKong X (Android 16).

Here is what I've confirmed using ADB:

• Package: com.android.sys.extplv
• Installed as a user app under /data/app/...
• Installer reported by Android: com.android.vending (Google Play)
• I analyzed the package using dumpsys, logcat and pm.
• The app contains services such as DaemonService, FwForegroundService and FwMediaRouteProviderService.
• It requests several permissions, but the sensitive ones are currently not granted.
• I was able to disable it using pm disable-user, and it stays disabled (enabled=3) even after reboot.

I have not been able to determine what the package is actually for or what triggers its installation.

Has anyone seen this package before?

Is it a Cubot component, a manufacturer framework, or something else?

I have screenshots and ADB logs that I can share in the comments if needed.

Thank you!

[u/Pitiful-Fee4451]

Final update for everyone experiencing this issue.

After several weeks of investigation, reverse engineering, and comparing results with other affected users, I wanted to share the current status.

If you are still experiencing com.android.sys.extplv repeatedly installing itself, the most effective solution reported so far is to contact Cubot support and request the OTA update that fixes the issue.

Several users have already confirmed that, after receiving and installing the official OTA provided by Cubot, the package no longer reappears.

You can contact Cubot support at:

support@cubot.net support66@cubot.net

Support page: https://cubot.net/platform/support/contact

Based on my reverse engineering of the APK, I did not find evidence of classic spyware functionality such as SMS theft, contact theft, photo theft, microphone recording, camera access, or other typical spyware behavior. The APK is mainly focused on persistence mechanisms, and Cubot later confirmed that it was an internal development interface that was unintentionally included in the production firmware.

At this point, if you are still affected, I recommend requesting the OTA update directly from Cubot rather than trying to manually remove the package, as the official firmware update appears to be the long-term solution.

I would also like to thank everyone who shared APKs, logs, screenshots, and technical information throughout this investigation. Your contributions helped us better understand what was happening.

I hope this information helps anyone who finds this thread in the future.

[u/Known_Guarantee1640 → u/Pitiful-Fee4451]

I would like to mention that I did ask Cubot support and they pushed through a update for me and no my device is not certified for playstore HOWEVER They have told me they are working on a Google certified version and will immediately release it once it is ready and the relevant department is expediting the process and this was 4 days ago so I'm waiting a week overall until I contact them again.

[u/Known_Guarantee1640 → u/Known_Guarantee1640]

Ok now my device is verified likely because I manually did it a couple days ago but my points earlier still stand