Suspected malware on stock apps in a Mediatek mtk65* based phone
9
votes
1
answer
5793
views
I have an old(2016) Mediatek mtk6580 chipset phone(non rooted/stock). Couple days back, I downloaded an app called "Apk extractor" from play store, and extracted the system apps to the sdcard. Then from there I uploaded them to https://virustotal.com and found out that, ***Android system framework***, ***com.mediatek***, ***Android system webview***, ***eSETterminal*** and ***Android browser provider*** had malwares in them. A couple days back, a serious vulnerability(mtk-su) for mediatek mt65** was found which gives a user temporary root privilege. I was able to obtain root permission and did
mount -o rw,remount /system
and went straight to /system/app/
and deleted ***Android system webview*** and ***Android browser provider***. However, I wasn't able to find ***com.mediatek*** on /system/app
and instead found it on /data/data
. I deleted that from there. But then I did a system reset. ***com.mediatek*** was still there. Also, I couldn't delete ***Android service framework***, because I tried doing adb shell pm uninstall -k --user 0 android
and couldn't access anything from the notification menu. For now I disabled the apps with adb shell pm uninstall -k --user 0 com.app.name
. Are there any ways to permanently delete ***com.mediatek***.
If it would help ya'll in any way I could attach a adb dumpsys and adb logcat logs. I noticed a few suspicious behaviors like, when I exit an app, the data/wifi completely bolts down, and vpn logs says **network change detected**. None of the other phones has this issue. I think I might be dealing with something big here.
Edit:
Okay, I don't happen to have all the links, but two of those apps were with me, and am providing the scan links here for eSet terminal and webview.
* Eset terminal https://www.virustotal.com/gui/file/b319236ee02778c88198e1b88e730b871f2709705728d766825a479652a7cec9/detection
* webview https://www.virustotal.com/gui/file/c1d4821e87519453ad5fc4e31fa4790cdc3a98dd45fd6015899a8f7093f6b784/detection
Asked by atheros
(393 rep)
Sep 7, 2020, 04:17 PM
Last activity: May 25, 2021, 04:24 AM
Last activity: May 25, 2021, 04:24 AM