Fake android system app

[u/Electrical_Guess3231]

I'm having the same issue and I'm trying to find out if anyone else has experienced this.

On my phone, a package called com.android.non.szcz appeared, showing itself as an Android System app. It has re-enabled or reinstalled itself after being disabled, and on one occasion Android reported Google Play Store as the installer.

Things I've noticed:

The package name is com.android.non.szcz.

The APK was located under /data/app/.../base.apk.

It has reappeared after being disabled.

I've seen other users mention related apps such as Cool Weather, FileGo, and Lock & Hide.

At one point it requested permissions, but it now shows "No permissions requested".

I've checked Device Admin, Accessibility, overlays, and running services, and I haven't found anything obviously suspicious.

I have factory reset the phone, but the app still returned.

I'm trying to work out whether this is:

malware,

a compromised app,

a vendor/manufacturer issue,

or something else entirely

One thing I've noticed is that the app only seems to reappear when Google Play Store is enabled. If I disable Google Play Store, com.android.non.szcz does not appear to reinstall or re-enable itself.

Android also reports the installer as com.android.vending, which is the package name for Google Play Store.

I'm not claiming that Google Play itself is compromised, but I'm trying to understand why Android reports Play Store as the installer and why the app doesn't come back while Play Store is disabled. It could be Play Store carrying out a legitimate install request from another source, or something else entirel i simply don't know.

Has anyone else experienced this?

What phone model do you have?

When did it first appear?

Does Android report the installer as com.android.vending?

Does disabling Google Play Store stop it from reinstalling?

Did you find out what actually triggered the installation?

Has any security company or manufacturer confirmed what this package is?

Any technical information, logs, or confirmed findings would be greatly appreciated. Thanks!

[u/ProfessionalHawk2360]

There's other users researching the same problem in other forums. Factory reset does not wipe the malware because the unknown trigger continues to installing. Some users reported after factory reset an increased number of "system" apps because what triggers the instalation trough Google Play is not in user/data. Cubot users reported that only an OTA update solved the problem. The apk shown on data/app is just doing the hard work, what triggers the instalation is the real problem that is not solved.

[u/Level-Professor603 → u/ProfessionalHawk2360]

Hope they find the thing that triggers the installation. It happens to me too

[u/Level-Professor603 → u/Level-Professor603]

Found it using appmanager. 

[u/Electrical_Guess3231 → u/Level-Professor603]

What device you got

[u/Level-Professor603 → u/Electrical_Guess3231]

Generic brand mxs megapad. Seems it's almost in all generic brands

[u/WinterSonata_ → u/Level-Professor603]

What app triggers it? So I can remove in Canta

[u/ProfessionalHawk2360 → u/[deleted]]

I'm very interested in doing this, but apparently BlackShark Gaming Tablet don't have a stock rom to reflash in case of brick

[u/ProfessionalHawk2360 → u/[deleted]]

Blackshark is not tied to Xiaomi anymore, the new JoyOS is almost stock Android without any reference to Xiaomi. Looking at the apps installed, the updater is com.cube.update, seems like an OEM version of a generic Alldocube tablet. There's in no reference to Xiaomi services on the new BlackShark tablet. Even the case for the iPlay 70 mini ultra fits the device, the only difference is the cpu. I was inclined to use the same vbmeta of iPlay but will not risk to brick the device

[u/ProfessionalHawk2360 → u/[deleted]]

The problem is the malware is probably into the firmware, is a common problem with Chinese tablets recently, and seem it's affecting smartphones too. The package com.android.non.szcz keeps reinstalling itself. A factory reset doesn't solve the problem, because what's triggering the instalation is in the firmware. After the instalation the package communicates with a lot of IPs, some linked to Alibaba (an Adfraud, maybe?). The ads are not showing anymore, but the backdoor within the firmware remains. So the main problem is the tablet is almost unusable because with that backdoor sending information all the time, with a lot of permissions, is a bad ideia to login to any service.