yashsingh1/xdaforums huggingface dataset:
[Device Reviews and Information] myjess:
The priv-app/SystemUI/SystemUI.apk inside this firmware

MP_mt6737_n370b_a48-4g_daoge_cc_128gbitp16d3_m_lte_3m-fdd-cs_mul_20160810-113920_songlixin_PC

Does not alert for any kind of trojan in any of the virustotal scans.

The priv-app/SystemUI/SystemUI.apk inside this firmware

MP_mt6737_n370b_a48-4g_daoge_cc_128gbitp16d3_m_lte_3m-fdd-cs_mul_20160829-203806_songlixin_PC

Shows Andr/Dropr-FY ONLY in sophos scan. No other VirusTotal Scan shows any trojan.

---------- Post added at 10:52 PM ---------- Previous post was at 10:45 PM ----------

The AdupsFota.apk which has the same icon as the wireless update, which was just triggered by the OTA update, has all these AV engines going nuts about it.

SHA256:	cbdea7d48daf9448a931f6ae2acda5b9d756b38466c48f9467a618340f3b73e3

File name:	AdupsFota.apk

Detection ratio:	13 / 55

Analysis date:	2016-11-04 22:49:41 UTC ( 1 minute ago )

1 0

Analysis

File detail

Additional information

Comments

Votes

Behavioural information

Antivirus	Result	Update

AVG	Android/G4P.CA.3CB554E2BF19	20161104

Ad-Aware	Android.Riskware.Agent.gXZJH	20161104

AegisLab	Android.Deng2.Mdm!c	20161104

Arcabit	Android.Riskware.Agent.gXZJH	20161104

BitDefender	Android.Riskware.Agent.gXZJH	20161104

Cyren	AndroidOS/GenPua.D176E85B!Olympus	20161104

ESET-NOD32	a variant of Android/Autoins.AK potentially unsafe	20161104

F-Secure	Android.Riskware.Agent	20161104

Fortinet	Android/Generic.Z.2E727A!tr	20161104

GData	Android.Riskware.Agent.gXZJH	20161104

K7GW	Trojan ( 004fb8021 )	20161104

McAfee	Artemis!D176E85B81E0	20161104

eScan	Android.Riskware.Agent.gXZJH	20161104

The other engines do not see anything wrong.
[Device Reviews and Information] thigger_tom:
Brilliant, thanks! Looks like this explains everything including why the ads have only recently appeared. I don't know why only Sophos picks it up because there's definitely a trojan in there based on the behaviour I've seen. Presumably people who aren't having issues haven't upgraded to the more recent firmware.

I've not heard from Doogee yet about the fact they're shipping a trojan.

Does anyone know if there are any issues downgrading firmware? It's slightly more complicated for my wife's phone in that she's had the OTA and is now 32-bit. I've temporarily firewalled everything but I don't think it's a good long term solution, especially as I've seen evidence of C&C type behaviour from another system app now.
[Device Reviews and Information] myjess:
Everything will be wiped on a downgrade/upgrade.

It is suspicious that Doogee do not have the OTA firmware on their website as the latest.

I cannot get into the system.dat file in the OTA update to see what packages are inside it, so I have no idea if the issues are still valid.

On malware bytes mobile forum there is a post about the adsupsfota.apk being a false +ve on another phone, but so many scan engines are flagging trojans in it, can it really be a false +ve?
[Device Reviews and Information] HypoTurtle:
I don't see why it couldn't be a false +ve; the app has access to download a file from a remote server [that probably isn't trusted as it's chinese]; and has the ability to reboot to recovery [and thus alter the system/data without user input] - so that could lead to some anti-virus calling it a trojan.

You won't be able to get into the .dat - I doubt there's actual files in there and that it's just a binary diff against the system partition.
[Device Reviews and Information] thigger_tom:
It's possible to avoid the wipe by deselecting 'data' in the flash tool (I've done it on an upgrade), but obviously it may have side effects.

As far as I can see, adupsfota is kind of a false positive in that it's just a delivery tool for updates. The worry is that it could be used to deliver anything including malware.

System UI (in the 0829 firmware and probably the OTA update if it's there) is definitely a trojan however.
[Device Reviews and Information] mattagazzu:
What about using 810 systemui apk in 829 firmware?
[Device Reviews and Information] thigger_tom:
Good idea, though I have some reservations given the traffic I've seen coming from one of the other system apps - but I'm willing to test it out and report back. Could someone on 810 please post up their systemui?
[Device Reviews and Information] myjess:
Here you go

Here you go. This is from the firmware. I have no idea how you are going to trust me that this is the one from 100816. I suppose if you put it through virustotal as a complete new analysis, that'd be the best way.
[Device Reviews and Information] thigger_tom:
Cheers. Given that right now there's definitely a trojan on the phone, it's hardly a problem sticking unknown files there!
[Device Reviews and Information] myjess:
Flashed mine back to 100816. Twrping and SU'ing and then first thing is disable wireless update. Next thing is install firewall again and look at logs.
[Device Reviews and Information] thigger_tom:
The 0810 systemui that myjess posted doesn't work in the latest OTA - phone works but there's no taskbar etc. I'm not sure if this is a 32/64 bit issue or something else but I think the only safe option is to stick with the 0810 firmware entirely for now.
[Device Reviews and Information] myjess:
AFwall (donated so I can see the firewall log files):

I would love to know why the kernel is pinging port 80 of amazon and alibaba, xaxis(a digital advertising company), Akamai International BV(Content Delivery Network (CDN) services) and probably a few others.

Is it Google play doing that I wonder, via the kernel?
[Device Reviews and Information] thigger_tom:
I think AFWall puts anything running as root down as 'kernel' - at least, that's what it suggests from 'old view'. I've just had a look on my Elephone P9000 (OK, it's another Chinese phone but I think they're pretty well respected) and it's doing something vaguely similar - a few IPs that aren't fully categorised in the whois database, Amazon, Akamai, Whatsapp etc. Not quite sure what's doing it though!
[Device Reviews and Information] Nonomen:
Have you the problems also with a 'virgin' phone. With no new apps installed?

I have no full screen advertisings.

Verstuurd vanaf mijn X5max_PRO met Tapatalk
[Device Reviews and Information] thigger_tom:
For anyone who's having issues with the trojan on the latest firmware (or those who aren't and are just concerned!) I've just 'dirty-flashed' the 0810 firmware to replace the October OTA update and even though it's 32->64 bit it seems to have worked fine.

Instructions:

Download 0810 firmware from needrom

SP flash tool - load scatter and then untick 'userdata'

Flash

Then I flashed TWRP (nb back to the 64-bit version), before booting into TWRP to flash SuperSU

Phone so far seems to work fine, all apps and data intact, and I haven't seen any 'naughty' behaviour yet on the firewall or packet capture.
[Device Reviews and Information] myjess:
So the kernel traffic that I talk about, you are not getting? I am flashed back to same as you.

Except I have also root uninstalled browser/snap/sherlocknews/docstogo/whatever that stupid keyboard is/ and maybe a few others.

And what's the deal with the "sim toolkit" which does not work anyway, can it be removed without affecting dual sim functionality?
[Device Reviews and Information] thigger_tom:
From AFWall:

AppID :	0
App Name:	(root) - Apps running as root
Total Packets Blocked:	37
[TCP]104.68.184.171:80(7)
[TCP]151.101.60.249:80(4)
[TCP]192.168.0.254:443(9)
[TCP]212.58.246.95:80(1)
[TCP]169.45.210.84:5222(9)
[2]224.0.0.22:0(7)

I'm not entirely sure what's going on, as this traffic doesn't appear when I use Packet Capture (or at least, it doesn't appear to be coming from the kernel). The last one there seems to be Whatsapp (which is installed on the phone). I don't know if AFWall could be miscategorising traffic from other apps? (It uses iptables so it'll be based on the user tagging from that). It's also strange that 192.168.0.254 appears there - that's a DD-WRT access point which isn't my router (that's on 1.254).

But I haven't seen anything that upsets me since downgrading the firmware in either AFWall or Packet Capture (apart from com.android.snap which had been undisabled on firmware reinstall) so I'm going to give the phone back to my wife and assume it's fixed. Not sure whether to leave AFWall on there if it's going to be blocking the packets listed above.
[Device Reviews and Information] myjess:
192.168.0.254 could be a test of a gateway. Pity we couldn't see what it was actually doing at this time. I wonder would it be trying to access the gateway with known passwords. ie: a hacking attack. Or maybe I am just being paranoid.

---------- Post added at 07:33 PM ---------- Previous post was at 07:10 PM ----------

wireless update start on reboot, or started by itself without me rebooting. Cannot remember when I last rebooted, but AFWALL just pinged me about it and lo and behold it is enabled. I am uninstalling the POC.
[Device Reviews and Information] thigger_tom:
Just about plausible - the phone gets a 192.168.0.x DHCP address but the gateway is 1.254 (I run /23 at home) - but I haven't seen any evidence of bad behaviour when running packet capture; I think that AFWall somehow miscategorises some traffic as being from root/kernel when it's actually coming from apps - eg the fact Whatsapp appears there in my logs.

Yep, noticed that myself - tenacious little bugger!
[Device Reviews and Information] seunot:
An idea whether Doogee will update this phone to Android N?
[Device Reviews and Information] torax242:
When you talk about the suspicious OTA - do you talk about the OTA from 20th of October or the new one that just appeared from 2nd November?
[Device Reviews and Information] thigger_tom:
The firmware with the trojan is the 0829 full firmware. It remains after the 1020 OTA update. I've not tried the 1102 one but as I'd have to flash 0829 (which we know is dodgy) then I'm going to stay on 0810 for now.

Anyone who has updated - could you please run a Sophos scan (and make sure 'system apps' is selected)? For some reason only Sophos seems to be capable of picking up the trojan. Though I think Doogee really needs to provide a full flashable firmware rather than OTA to keep it clean.
[Device Reviews and Information] torax242:
I've run Sophos: the System-UI Andr/Dropr-FY is still in the BOOGEE-X5max_PRO-Android6.0-20161102 build.
[Device Reviews and Information] Kenif1983:
I'm installing latest OTA. It's been over 40 minutes..

It seemed to be working fine, booted up, did the "android is upgrading app x out of y"

Then it rebooted and has displayed the blue and orange footer logo for at least 5 mins.

I'm slightly concerned.

---------- Post added at 07:11 PM ---------- Previous post was at 06:57 PM ----------

After another 5 mins I held the power button top reset.

Phone's working but loads of apps disappeared...

Not happy with this Ota
[Device Reviews and Information] Nonomen:
Did the 11-02 this afternoon. No problems. Snap still disabled and yes only sophos finds Dropr-FY.

Verstuurd vanaf mijn X5max_PRO met Tapatalk
[Device Reviews and Information] HypoTurtle:
Are you sure the Sophos scan isn't a false +ve due to the Wireless OTA app?

On 0810 - is there a seperate OTA app? As opposed to the hiden app and the app launch button in Settings==>About.

To clarify could the report [did a bit of googling] be due to there being an ota launcher.

---Wrote this when I thought the report was on Settings.apk and not SystemUI--- might see if pulling apart the apk will yield anything.
[Device Reviews and Information] Al3xandar:
I did OTA update this morning with no problems. It took a bit long to prepare apps (I have ~90) after rebooting (and the Doogee logo), so I guess it was preparing apps for you but somehow it didn't show it (white popup with progress bar on black screen), it was still showing logo for you, so when you did the reset you interrupted the process, so some of your apps disappeared. Did you have the latest firmware before this?
[Device Reviews and Information] Kenif1983:
It did the whole upgrading of my apps (I have 67) then rebooted. It then gave me the logo for 10 mins.

I reinstalled a couple of the apps and the rest seem to have came back (possibly on the SD card?!?)

Currently seems to be working. Not noticed many changes
[Device Reviews and Information] Al3xandar:
Did you have the latest firmware before this OTA? For me, previous OTA removed some apps and I had to reinstall them, but then I noticed in All apps list under My Apps & Games in Play Store that there were few games that were not compatible with my phone any more. So I assumed it's because they swapped from 64bit to 32bit with previous OTA, and that those apps I had to reinstall were 64bit. So could be that if you didn't install previous OTA?

Also, has anyone noticed that with 1102 firmware some icons are smaller. From stock apps it's File Manager, Messaging, Music and perhaps Parallel Space and SIM Toolkit. From other apps I noticed it on Avast Mobile Security, also for Google+ but only on the home screen, not in the app drawer.

Edit: 3 apps that I just updated through Play Store all got their icons shrunk, plus Amazon Underground app as well, which probably did the self update. Anyone else having this problem?
[Device Reviews and Information] mattagazzu:
Screen Mirroring (Miracast) support?

Hi guys.

What about screen mirroring via miracast on our X5 max pro? It is not present? How can it be enabled?
[Device Reviews and Information] mig77:
Help! I need the Original Stock-Recovery from the Firmware of 20.10.2016. Many Thanks.
[Device Reviews and Information] Kenif1983:
Edit: ignore
[Device Reviews and Information] Steve_Goral:
Just caught up with all this, I'm still on 0708 firmware but I'll be updating later. Just to confirm, will the updater in the About settings menu allow me to update as the OTA option constantly tells me that my phone is up to date and clearly it isn't. Also, I can't root the phone as it disables my Barclays on-line banking.
[Device Reviews and Information] Al3xandar:
Does anyone else have a problem with 1102 that each app that gets updated get its icon shrunk. Home screen now looks weird with some icons being large and some tiny. Is there a way to fix this without installing 3rd party launcher?
[Device Reviews and Information] Steve_Goral:
So go on guys, which is the most stable firmware version at the moment?
[Device Reviews and Information] Kenif1983:
I can't buy an app.

"Google play store has stopped" anyone else
[Device Reviews and Information] Kenif1983:
I had to use sp flash tool to update using a download from the doogee website. Then ota worked
[Device Reviews and Information] Steve_Goral:
Cool, I'll get downloading now. I'm getting a fair few force closes so it could probably do with updating.
[Device Reviews and Information] Steiner91:
Hey there,

could anybody resolve the issue with Whatsapp-Web?

So far I'm content with this smartphone but for this one annoying bug that I cannot scan the barcode of the Whatsapp-Website. I guess it's a problem with the app, because a seperate barcode-scanner-app works quite well.

Would be a pity to send it back because of this, the next viable smartphones cost at least 50% more.

Best regards
[Device Reviews and Information] DANIELE_ZIGLIOLI:
Hello everyone! are possessor of Doogee x5 max pro and I found problems with bluetooth, I can not pair it with devices that require operating system Android 4.4 or higher and Bluetooth version 4.0. Does anyone know if you can solve or better to give up? Thank's .Daniele

Inviato dal mio X5max_PRO utilizzando Tapatalk
[Device Reviews and Information] thigger_tom:
Re the virus/trojan in SystemUI.apk - I've had an email from Doogee saying they're looking into it, so they're definitely aware now.

I presume 0810 is still the most recent firmware without it?

Interestingly, I've just rescanned it with Virustotal and now a lot more viruskillers are detecting it (previously it was only Sophos):

https://www.virustotal.com/en/file/...9e57c7f86078dabc017737c0/analysis/1479209913/

Seems to be the "Triada" trojan which sounds like a particularly horrible bit of software.
[Device Reviews and Information] Steve_Goral:
Bit of an issue with the update, it's totally wiped my phone and now it's saying I need to format the SD card. This would be fine but foolishly I left the backup files on there and now I can't read it with either the phone or my laptop, is there a way to access these files or is it just going to be one of those hard lessons?

BTW, I had it used as the internal storage rather than removable.
[Device Reviews and Information] mates.bucko:
Hi,any ideas how to turn on the 700 4g lte frequency? I heard that sometimes it is possible few years ago. I am with Fido here in Canada and that's the only frequency which I am missing.

Odesláno z mého X5max_PRO pomocí Tapatalk
[Device Reviews and Information] myjess:
Should we be scared?

http://mobile.nytimes.com/2016/11/1...retly-sending-users-texts-China-72-hours.html

Also,

https://blog.kaspersky.com/triada-trojan/11481/

This article about triada trojan says kaspersky can find 3 versions of it. But I don't think kaspersky has flagged it in the virus total output.
[Device Reviews and Information] Al3xandar:
I ran scans with Kaspersky, Avast and Malwarebytes' and neither of them have found any threats. Malwarebytes' used to detect that com.android.snap as a threat on previous firmware versions, not this time with latest firmware.
[Device Reviews and Information] diogo.silva.nascimento:
I unlocked the bootloader successfully.

But by sending the TWRP x32 to the phone it always comes back to Android recovery.

Does anyone know what to do to run TWRP?

I'm on latest update via OTA.
[Device Reviews and Information] thigger_tom:
How does Sophos look on the latest firmware (with scanning system apps turned on)? That was the first one to correctly identify it.
[Device Reviews and Information] mates.bucko:
Hi, did you already recieved the phone? How it works for you? For me it looks like lte doesn't work. Other thing - did anyone checked the processor with cpu-z? It looks like in mine is MTK 6735 instead of 6737.
[Device Reviews and Information] diogo.silva.nascimento:
Does LTE have a compatible frequency with the smartphone? Here in Brazil we use band 7 (2600mhz) and it works very well.
[Device Reviews and Information] mates.bucko:
Well, I changed the APN and now it works! Still have to test it,but looks good now! About the processor, cpu-z says it is 6735, antutu says it is 6737,so it is probably ok :)
[Device Reviews and Information] nikostzar:
Hello,

I caught up with the beautysnap adware on version 0708 and contacted my local reseller. They had me send the phone to them and returned it to me with the 1020 firmware, saying everything is now ok....

Of course now, on top of beautysnap I have the malware on systemUI which appears to be the triada trojan (???!?!?!?!!)

I have asked them if I can send the phone back and get a refund but from our communication so far I don't believe they will accept this.

So where does this leave us? What are our options?

Is the 0810 the safest firmware? But it still has the adware, right?

Also, is there an easy way to roll back from 1020 to 0810 (and is this safe enough?) for someone like me who doesn't have any experience with smartphones?

Thank you!

---edit---

Also can someone please explain why there is no outrage about this issue? Is it considered OK to have this kind of malware shipped with your phone? Is it well known that if you buy cheap phones you will get a few trojans to make up for the low price? (these are honest questions, that's my first smartphone and I am really freaking out with this story...) Thanks again
[Device Reviews and Information] Nonomen:
Anyone succeeded in cleaning the lens of the rear camera?
[Device Reviews and Information] torax242:
Why should there be any outrage - of course this is terrible. But the Doogee X5 Max Pro is the cheapest useable Android 6 phone imaginable and Doogee is a company without any public appearance at all. You could be angry, you could vow to never buy any Doogee product ever again but it won't matter. I pity anyone who relies on this phone as the main device. Nobody deserves this.

Unless someone is willing to invest his/her time to build a working custom rom (which I doubt will ever happen as there are too many budget phones available that the chances of attracting a custom rom community around this one are rather slim) we will be stuck with a pest-infested, Dirty Cow vulnerable phone for eternity.

Sorry for not raging out.
[Device Reviews and Information] rufy93:
Of course it is not alright to have malware in a phone, but as [MENTION=3834635]torax242[/MENTION] mentioned, the community for this phone/brand is too small to really make any big news. We are today so used to giving away our personal information to various companies in US (and maybe Europe?) but giving the same information to Chinese corporations feels wrong.

Anyways, my solution for this issue was to root (quite painless actually) and install a firewall. The only apps allowed access to internet are the ones I have manually installed and trust. Most of the system apps (such as GApps) have been updated to playstore. Only not-updated items allowed is now Calendar sync.
[Device Reviews and Information] nikostzar:
Torax thank you for your reply and I am sorry if I sounded judgmental, that was not my intention (English is not my first language).

I get your point (and rufy's) about the small community around this phone.

I just believe this information should be available to customers. Had I known this beforehand I would have gladly payed 20-30 more euros for another brand.

Anyway, complaining won't clean my phone so I will do some research about rooting and installing a root firewall. (If you can point me to any tutorial for dummies I would be thankful)

Thanks again for the replies! :good:
[Device Reviews and Information] rufy93:
Very much agree on you regarding buying another brand.
[MENTION=7304512]jan177[/MENTION] wrote a very nice tutorial earlier in this thread.

http://xdaforums.com/showpost.php?p=68021440&postcount=41

One thing to note is if you have performed any of the OTA upgrades (October or later) you may need a 32-bit recovery which i available later in the thread (around page 25 somewhere i think).
[Device Reviews and Information] Al3xandar:
I did, it was easy, but it's definitely something you'll have to do every month or two.
[Device Reviews and Information] Nonomen:
Can you post a tutorial?