Sample Header Ad - 728x90

Weird package "com.google.ccc.abuse.droidguard.droidguasso"

5 votes
2 answers
3392 views
Recently my phone shows "Android is starting Optimizing App 1 of 1" at every boot. I intercepted this and found it running dex2oat in this way
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg /system/framework/XposedBridge.jar --instruction-set=arm64 --instruction-set-features=default --runtime-arg -Xnorelocate --boot-image=/system/framework/boot.art --dex-file=/data/data/com.google.android.gms/app_fb/f.apk --oat-fd=45 --oat-location=/data/data/com.google.android.gms/app_fb/f.dex --runtime-arg -Xms64m --runtime-arg -Xmx512m
I also managed to grab a copy of the APK. The original APK and DEX *disappears* after dex2oat is done. Its package ID is com.google.ccc.abuse.droidguard.droidguasso and it's only 6.5KB in size. There's not even a META-INF folder in the APK. Google shows no exact result about it. I'm afraid whether it's a malware but I can't find out anything more. Can anyone help me? I have the intercepted APK uploaded to Dropbox . Edit: Got rid of it by creating a blank *file* at /data/data/com.google.android.gms/app_fb. But I still wonder about its malice (if so).
Asked by iBug (7977 rep)
Apr 16, 2017, 06:42 AM
Last activity: Oct 21, 2024, 07:36 PM