Recently my phone shows "Android is starting Optimizing App 1 of 1" at every boot. I intercepted this and found it running dex2oat
in this way
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg /system/framework/XposedBridge.jar --instruction-set=arm64 --instruction-set-features=default --runtime-arg -Xnorelocate --boot-image=/system/framework/boot.art --dex-file=/data/data/com.google.android.gms/app_fb/f.apk --oat-fd=45 --oat-location=/data/data/com.google.android.gms/app_fb/f.dex --runtime-arg -Xms64m --runtime-arg -Xmx512m
I also managed to grab a copy of the APK. The original APK and DEX disappears after dex2oat
is done. Its package ID is com.google.ccc.abuse.droidguard.droidguasso
and it's only 6.5KB in size. There's not even a META-INF
folder in the APK. Google shows no exact result about it.
I'm afraid whether it's a malware but I can't find out anything more. Can anyone help me?
I have the intercepted APK uploaded to Dropbox.
Edit: Got rid of it by creating a blank file at /data/data/com.google.android.gms/app_fb
. But I still wonder about its malice (if so).