Weird package "com.google.ccc.abuse.droidguard.droidguasso"

Question

Recently my phone shows "Android is starting Optimizing App 1 of 1" at every boot. I intercepted this and found it running dex2oat in this way

/system/bin/dex2oat --runtime-arg -classpath --runtime-arg /system/framework/XposedBridge.jar --instruction-set=arm64 --instruction-set-features=default --runtime-arg -Xnorelocate --boot-image=/system/framework/boot.art --dex-file=/data/data/com.google.android.gms/app_fb/f.apk --oat-fd=45 --oat-location=/data/data/com.google.android.gms/app_fb/f.dex --runtime-arg -Xms64m --runtime-arg -Xmx512m

I also managed to grab a copy of the APK. The original APK and DEX disappears after dex2oat is done. Its package ID is com.google.ccc.abuse.droidguard.droidguasso and it's only 6.5KB in size. There's not even a META-INF folder in the APK. Google shows no exact result about it.
I'm afraid whether it's a malware but I can't find out anything more. Can anyone help me?

I have the intercepted APK uploaded to Dropbox.

Edit: Got rid of it by creating a blank file at /data/data/com.google.android.gms/app_fb. But I still wonder about its malice (if so).

Answer 1

Disclaimer

This APK's code is obfuscated, hence it's difficult to ascertain its purpose. For those who have doubts concerning my analysis — and I encourage you to —, feel free to download the decompiled APK from my MEGA account.

---

Analysis

First and foremost, I'd like to state that there are five characteristics of this code that made me think:

1. the code is obfuscated;
2. no permissions are ever declared inside the AndroidManifest.xml;
3. even if the code itself is obfuscated, there are strings which mention EGL, shaders and rendering;
4. a method in the code probes the device's graphic card;
5. this APK is not signed.

As for point 1, I often decompiled Google's apps, and they do like to obfuscate their code.

Point 2 greatly limits the potential nefarious actions an app can perform, as long as the app doesn't inherit its permissions by another app.

Points 3 and 4 seems to hint at a software which is devoted to draw on the display.

Point 5 is fascinating, as Android's package installer doesn't normally allow installing unsigned packages.

---

Guess

My guess is that this is a piece of software developed from Google, by Google. The APK is unsigned, but it might theoretically be installed by a system app, thus bypassing the signature restriction.

Answer 2

I have reason to believe that com.google.ccc.abuse.droidguard.droidguasso is Droidguard (a Google safety tool). There's minimal information about it on the web, and the best source for SafetyNet information (which is related to Droidguard) has explicitly said that he would not publish information on it as it would only be useful to attackers. Touching on the other answer, SafetyNet is not an obfuscated package, and just contains the classes.dex file. As Droidguard is indeed obfuscated whereas SafetyNet isn't, my guess is that Droidguard evolves slower than SafetyNet.