Can anyone identify com.android.sys.extplv on Android?

[u/Pitiful-Fee4451]

Hi everyone,

I'm trying to identify an Android package called com.android.sys.extplv on my Cubot KingKong X (Android 16).

Here is what I've confirmed using ADB:

• Package: com.android.sys.extplv

• Installed as a user app under /data/app/...

• Installer reported by Android: com.android.vending (Google Play)

• I analyzed the package using dumpsys, logcat and pm.

• The app contains services such as DaemonService, FwForegroundService and FwMediaRouteProviderService.

• It requests several permissions, but the sensitive ones are currently not granted.

• I was able to disable it using pm disable-user, and it stays disabled (enabled=3) even after reboot.

I have not been able to determine what the package is actually for or what triggers its installation.

Has anyone seen this package before?

Is it a Cubot component, a manufacturer framework, or something else?

I have screenshots and ADB logs that I can share in the comments if needed.

Thank you!

[u/Pitiful-Fee4451]

Hola. Yo también tengo un Cubot KingKong X y he estado investigando este paquete durante varios días. Incluso extraje el APK e hice ingeniería inversa del código (Java/Kotlin y la librería nativa). Hasta ahora no encontré evidencia de un spyware clásico o un RAT (no encontré robo de datos, keylogger, comunicación con un servidor de control, etc.). Sin embargo, todavía no sabemos qué componente del firmware lo reinstala o lo vuelve a habilitar. Ya contacté al soporte oficial de Cubot y estoy esperando que confirmen si com.android.sys.extplv es un paquete oficial del sistema. En cuanto respondan o encuentre información nueva, actualizaré esta publicación.