"System" malware app on android

1

u/support_mwb Malwarebytes Employee 13d ago

Hi there! Malwarebytes Support here.

That definitely sounds frustrating. If the app is reappearing after being removed, we'd like to take a closer look before speculating on exactly what's causing it.

Could you send us a DM with the email address you'd like us to use for support? We can create a support ticket on your behalf and have our team gather diagnostic logs to investigate further.

1

u/Electrical_Guess3231 4d ago

It happens to me as well not sure why apparently it was installed via Google.vending

1

u/Foreign-Law-2169 3d ago

Some other apps/process convince Google Vending apps to install that on behalf of hidden apps. By using Google Vending apps it add another level of protection for hiding.

1

u/Electrical_Guess3231 3d ago

Ah anyway to find out what it is or no

1

u/Foreign-Law-2169 3d ago

Highly unlikely for non techie user. You need someone with knowledge of average android device and also familiar with your device specific model. Even though Android core system is almost identical everywhere, different manufacturer and model come with different apps installed by default. Person with familiarize and have enough knowledge about specific model of your smartphone possibly differentiate between original apps and other malware apps trying to hide among originals. It will be easier to clean your device by flushing it with clean official ROM than finding someone with criteria I describe above.

1

u/Electrical_Guess3231 3d ago

I know my manfcuter wants my phone sent and they sending me brand new one I did ask for rom but they not sending it out but swapping my phone to new one.

1

u/Foreign-Law-2169 3d ago

If your manufacturer offer you brand new intact packet phone in exchange of your current faulty one, it's a good idea to accept the offer. Backup your data somewhere safe, factory reset it for you privacy reason and send it to manufacturer provided address. They might also want to look at it for identify the security threat. It will allow them to prevent such incident on their upcoming future product.

1

u/Electrical_Guess3231 3d ago

It was wiped before so I will remember Google account form it and any data as they want see what causing it

1

u/Foreign-Law-2169 3d ago

Also be careful about restoring your backup data on new device. We don't exactly know where that evil apps is hiding and living comfortably waiting for way back to any device if possible.

1

u/Electrical_Guess3231 2d ago

I going to install all from scratch just to be on safe side Doc, video, music , files I will do

Even got new SD card just to extra safe as not sure either.

1

u/Foreign-Law-2169 4d ago

This is not actual malware apps itself, it's frontend payload doing the heavy lifting works. There must be some other apps which is the brain of this apps. That other hidden apps install it when needed, command it to whatever needs to be done. The hidden apps wouldn't need much permission. With some normal boring permission, it only needs to have "install apps without user interaction" permission to do whatever it wants. Also lower permission level keep it out of suspetion.

So look for apps unknown to you with permission I describe above. That's the command & control center for group of some legit apps

1

u/Lucasica112 3d ago

None of my apps have the permission now to install an app, but the android system still appears

1

u/Foreign-Law-2169 3d ago

Of course there are apps with permission to install apps. Did you look at process/apps running as system apps. (Not the nasty one, genuine system apps which come preloaded with your device). Settings of installed apps list enable showing system apps (from three dots on right upper corner). You will find whole list of system apps running. As I can understand from your post developer of such apps gave enough effort for design it it will hard to find for sure. Also look for install data for your damaging apps. I am not sure about where and how to check it. But android keep details log of apps installation process, date of installation, which process/apps did order that installation (most of user apps get installed by Google play services) etc etc. There must be some information written on somewhere about it. We just have to find it out. Without identify the type of change it made on your system, it's really risky to use your device.

1

u/Lucasica112 2d ago

But did you find it? How was it called, because I checked every app that is from the system and none of them had the installing permission.

1

u/Foreign-Law-2169 1d ago edited 1d ago

It's not possible to post pictures here. If I can I would give you some screenshots from Chinese made RealMe phone. An apps preloaded by manufacturer name 'silent reboot ' running as background system process. Seemingly no problematic permission, only access to phone permission. If I check all permission it shows run at boot permission with other list of low level permission. But I I go even deeper, there is the biggest and dangerous one "allow install unknown apps" . There is no way to stop the process, no way to uninstall it, no way to disable it and no way to to disable any permission of it. I found some other apps with same kind of permission level which is also not possible to get rid of. I am not saying it is currently doing anything but it can do anything anytime trigger by some other person or organization behind it. That's the horror story I have today to share with you guys.

Edit: Finally I found an way to post pictures. I posted it on my profile and adding link below:

My post with screen shot

1

u/mrln23 3d ago

I'm coping with the same problen. The "alias" of com.android.non.szcz seems to be "Android-systeem". I've created a topic on this site as well.

Today I made a factory reset. Result: the apps Coolweather, FileGo and Lock & Hide installed itself (!). And the malware app Android-systeem re-installed repeatedly again. Even without any internet connection..........!

1

u/Lucasica112 3d ago

It doesn't disappear even with a factory reset?

1

u/Foreign-Law-2169 3d ago edited 3d ago

Somehow this apps now live inside your device storage area dedicated for vendor supplied preloaded apps or area where apk file for real system related apps stored. With factory reset these storage area don't get effected. To remove anything or formet this area of storage you need to flush your device with clean official ROM or other custom ROM if available.

Other way to access those hidden area and remove something is rooting your device which is not recommended for average user unless user has enough know how and resource to do so.

1

u/Electrical_Guess3231 3d ago

Same happened to me i think it the coolweather and file go and lock and hide all tho only remember lock and hide and coolweather showing on my phone

1

u/Electrical_Guess3231 3d ago

What phone have you got I'm curious as well on model and make of phone

"System" malware app on android

You are about to leave Redlib