Anatomy of a haxored Android phone

I’ve been searching for a way to identify if a Samsung android phone has been compromised by a rootkit or forensics software by the police. Haven’t done it yet but here is some extra info on a few .apk’s that i figured might be involved in keystroke logging etc.

root@kmini3g:/system/app # ls
AccessControl.apk
AccessControl.odex
AccuweatherPhone2014_HD.apk
AllShareCastPlayer.apk
AllShareCastPlayer.odex
AllshareControlShare.apk
AllshareFileShare.apk
AllshareFileShare.odex
AllshareFileShareClient.apk
AllshareFileShareClient.odex
AllshareFileShareServer.apk
AllshareFileShareServer.odex
AllshareMediaServer.apk
AllshareMediaServer.odex
AllshareMediaShare.apk
AllshareMediaShare.odex
ApplicationsProvider.apk
ApplicationsProvider.odex
AssistantMenu2.apk
AssistantMenu2.odex
BCService.apk
BCService.odex
BadgeProvider.apk
BadgeProvider.odex
BandService.apk
BasicDreams.apk
BasicDreams.odex
Bluetooth.apk
Bluetooth.odex
BluetoothTest.apk
BluetoothTest.odex
Blurb.apk
Books.apk
Bridge.apk
Bridge.odex
BrowserProviderProxy.apk
CapabilityManagerService.apk
CertInstaller.apk
CertInstaller.odex
ChocoEUKor.apk
Chrome.apk
ChromeCustomizations.apk
ChromeCustomizations.odex
ClipboardSaveService.apk
ClipboardSaveService.odex
ClockPackage.apk
ColorBlind.apk
ColorBlind.odex
CoolEUKor.apk
DigitalClock.apk
DigitalClock.odex
DigitalClockEasy.apk
DigitalClockEasy.odex
DirectConnect.apk
DirectConnect.odex
DocumentsUI.apk
DocumentsUI.odex
Drive.apk
Dropbox.apk
DropboxOOBE.apk
DualClockDigital.apk
DualClockDigital.odex
ELMAgent.apk
ELMAgent.odex
EasySettings.apk
EasySettings.odex
EasymodeContactsWidget.apk
EasymodeContactsWidget.odex
EdmSimPinService.apk
EdmSimPinService.odex
EdmVpnServices.apk
EdmVpnServices.odex
EmergencyLauncher.apk
EmergencyLauncher.odex
EmergencyModeService.apk
EmergencyModeService.odex
EmergencyProvider.apk
EmergencyProvider.odex
FWUpgrade.apk
FWUpgrade.odex
FactoryCamera_FB.apk
FixmoISA.apk
Flipboard.apk
GMS_Maps.apk
GearManagerStub.apk
GeoLookout.apk
GeoLookout.odex
Gmail2.apk
GoogleCalendarSyncAdapter.apk
GoogleContactsSyncAdapter.apk
GoogleTTS.apk
Hangouts.apk
Headlines.apk
Headlines.odex
InCallUI.apk
InCallUI.odex
InteractiveKeyguardTutorial.apk
InteractiveKeyguardTutorial.odex
InteractiveTutorial.apk
InteractiveTutorial.odex
InterfacePermissions.apk
KNOXAgent.apk
KNOXAgent.odex
KeyChain.apk
KeyChain.odex
KnoxAttestationAgent.apk
KnoxAttestationAgent.odex
KnoxSetupWizardClient.apk
KnoxSetupWizardClient.odex
LocalFOTA.apk
MDMApp.apk
MDMApp.odex
Magazines.apk
MediaConverter_Trim.apk
MediaUploader.apk
MobilePrint4.apk
MobilePrint4.odex
MobilePrintSvc_CUPS.apk
MobilePrintSvc_CUPS_Backend.apk
MobilePrintSvc_Epson.apk
MobilePrintSvc_HP.apk
MobilePrintSvc_Samsung.apk
MobilePrintSvc_WFDS.apk
MobileTrackerEngineTwo.apk
MobileTrackerEngineTwo.odex
Music2.apk
MusicCommonUtility.apk
MusicCommonUtility.odex
MusicLiveShare2.apk
MusicLiveShare2.odex
PacProcessor.apk
PacProcessor.odex
PackageInstaller.apk
PackageInstaller.odex
PartnerBookmarksProvider.apk
PartnerBookmarksProvider.odex
Personalization.apk
Personalization.odex
PhotoTable.apk
PhotoTable.odex
PickUpTutorial.apk
PickUpTutorial.odex
PlayGames.apk
PlusOne.apk
PolarisViewer5.apk
PopupuiReceiver.apk
PopupuiReceiver.odex
Preconfig.apk
Preconfig.odex
PreloadInstaller.apk
PreloadInstaller.odex
QComQMIPermissions.apk
QuickConnect.apk
QuickConnect.odex
QuickConnectInteraction.apk
QuickConnectInteraction.odex
RCPComponents.apk
RCPComponents.odex
RootPA.apk
RootPA.odex
RoseEUKor.apk
SBrowser.apk
SBrowser.odex
SBrowserTry.apk
SBrowserTry.odex
SCONE_Android_ProxyService.apk
SCParser.apk
SNameCard.apk
SPenSdk3.apk
SPlanner.apk
SPlanner.odex
SPlannerWidget.apk
SPlannerWidget.odex
SPrintSpooler2.apk
SPrintSpooler2.odex
SViewCoverService.apk
SViewCoverService.odex
SafetyInformation.apk
SafetyInformation.odex
SamsungAppsWidget_Phone_Carrier_VZW.apk
SamsungCamera3.apk
SamsungCamera3.odex
SamsungContentsAgent.apk
SamsungDrmProvider.apk
SamsungDrmProvider.odex
SamsungIME.apk
SamsungIME.odex
SamsungMagnifier.apk
SamsungMagnifier.odex
SamsungMusic_20.apk
SamsungMusic_20.odex
SamsungSans.apk
SamsungTTS.apk
SamsungWidget_ActiveApplication.apk
SamsungWidget_ActiveApplication.odex
SapaMonitor.apk
SecCalculator2_ESS.apk
SecCalculator2_ESS.odex
SecDownloadProviderUi.apk
SecDownloadProviderUi.odex
SecEmail_K.apk
SecEmail_K.odex
SecExchange.apk
SecExchange.odex
SecFactoryPhoneTest.apk
SecHTMLViewer.apk
SecHTMLViewer.odex
SecKidsModeInstaller.apk
SecKidsModeInstaller.odex
SecMemoDL.apk
SecSetupWizard2013.apk
SecSetupWizard2013.odex
SecTelephonyProvider.apk
SecTelephonyProvider.odex
SecurityProviderSEC.apk
SecurityProviderSEC.odex
SetDefaultLauncher.apk
SetDefaultLauncher.odex
SettingSearchProvider.apk
SettingSearchProvider.odex
SharingAccessibilitySettings.apk
SharingAccessibilitySettings.odex
ShootingModeProvider.apk
ShootingModeProvider.odex
SilentLog.apk
SilentLog.odex
SmartRemote_K.apk
SmartcardManager.apk
SmartcardManager.odex
SmartcardService.apk
SmartcardService.odex
Stk.apk
Stk.odex
Stk2.apk
Stk2.odex
Street.apk
Superuser.apk
SysScope.apk
TaskManager.apk
TaskManager.odex
TasksProvider.apk
TasksProvider.odex
TcpdumpService.apk
TcpdumpService.odex
TetheringAutomation.apk
TetheringAutomation.odex
TimeService.apk
TimeService.odex
TravelService_K.apk
TravelService_K.odex
USBSettings.apk
USBSettings.odex
UniversalMDMClient.apk
UserDictionaryProvider.apk
UserDictionaryProvider.odex
Videos.apk
VoiceNote.apk
WeatherDaemon2014.apk
WebManual.apk
WebManual.odex
WfdBroker.apk
WfdBroker.odex
WlanTest.apk
WlanTest.odex
Wluc.apk
Wluc.odex
YouTube.apk
atfwd.apk
atfwd.odex
com.qualcomm.location.apk
com.qualcomm.location.odex
mcRegistry
minimode-res.apk
operamini-7.5.34817.apk
ringtoneBR.apk
ringtoneBR.odex
talkback.apk

ELMAgent.apk – Samsung bloatware apparently. Probably for getting on MS networks.

KNOXAgent.apk – Provides root access.

 

TalkBack is an Accessibility Service that helps blind and vision-impaired users interact with their devices.Talkback adds spoken, audible, and vibration feedback …

Scroll to Top