-1

Today I downloaded a fun app named Rubika and extracted its apk file in android studio and noticed a very strange part in its android manifest.

<application
    android:theme="@ref/0x7f110170"
    android:label="@ref/0x7f100086"
    android:icon="@ref/0x7f0e0002"
    android:name="org.telegram.messenger.ApplicationLoader"
    android:manageSpaceActivity="org.telegram.ui.ManageSpaceActivity"
    android:allowBackup="false"
    android:hardwareAccelerated="@ref/0x7f050007"
    android:largeHeap="true"
    android:supportsRtl="true">

    <service
        android:name="ir.resaneh1.iptv.appUpdate.DownloadService" />

    <activity
        android:name="ir.resaneh1.iptv.activity.PlayerTestActivity"
        android:configChanges="0x4b0" />

    <activity
        android:name="ir.resaneh1.iptv.activity.QueueTestActivity"
        android:configChanges="0x4b0" />

    <activity
        android:theme="@ref/0x7f11017b"
        android:name="ir.resaneh1.iptv.fragment.SendImageDialogActivity"
        android:configChanges="0x4b0" />

    <activity
        android:theme="@ref/0x7f11017b"
        android:name="ir.resaneh1.iptv.fragment.SendVideoDialogActivity"
        android:configChanges="0x4b0" />

    <activity
        android:theme="@ref/0x7f11017b"
        android:name="ir.resaneh1.iptv.activity.SendVoiceDialogActivity"
        android:configChanges="0x4b0" />

    <activity
        android:theme="@ref/0x7f11017b"
        android:name="ir.resaneh1.iptv.appUpdate.UpdateActivity"
        android:configChanges="0x4b0"
        android:windowSoftInputMode="0x22" />

    <activity
        android:name="ir.resaneh1.iptv.loginIntro.IntroActivity"
        android:screenOrientation="1" />

    <activity
        android:name="ir.resaneh1.iptv.loginIntro.LoginActivity"
        android:launchMode="2"
        android:screenOrientation="1"
        android:configChanges="0x4b0"
        android:windowSoftInputMode="0x20" />

    <activity
        android:name="ir.resaneh1.iptv.loginIntro.LoginActivitySecondPage"
        android:launchMode="2"
        android:screenOrientation="1"
        android:configChanges="0x4b0"
        android:windowSoftInputMode="0x20" />

    <activity
        android:name="ir.resaneh1.iptv.MainActivity"
        android:launchMode="2"
        android:configChanges="0x4b0"
        android:windowSoftInputMode="0x20"
        android:hardwareAccelerated="@ref/0x7f050007">

        <intent-filter>

            <action
                android:name="android.intent.action.MAIN" />

            <category
                android:name="android.intent.category.LAUNCHER" />

            <category
                android:name="android.intent.category.MULTIWINDOW_LAUNCHER" />
        </intent-filter>
    </activity>

    <service
        android:name="ir.resaneh1.iptv.notification.MyFirebaseMessagingService">

        <intent-filter>

            <action
                android:name="com.google.firebase.MESSAGING_EVENT" />
        </intent-filter>
    </service>

    <service
        android:name="ir.resaneh1.iptv.notification.MyFirebaseInstanceIDService">

        <intent-filter>

            <action
                android:name="com.google.firebase.INSTANCE_ID_EVENT" />
        </intent-filter>
    </service>

    <meta-data
        android:name="com.google.firebase.messaging.default_notification_icon"
        android:resource="@ref/0x7f080269" />

    <provider
        android:name="android.support.v4.content.FileProvider"
        android:exported="false"
        android:authorities="ir.resaneh1.iptv.provider"
        android:grantUriPermissions="true">

        <meta-data
            android:name="android.support.FILE_PROVIDER_PATHS"
            android:resource="@ref/0x7f130004" />
    </provider>

    <service
        android:name="com.google.firebase.messaging.FirebaseMessagingService"
        android:exported="true">

        <intent-filter
            android:priority="-500">

            <action
                android:name="com.google.firebase.MESSAGING_EVENT" />
        </intent-filter>
    </service>

    <activity
        android:theme="@ref/0x01030010"
        android:name="ir.pec.mpl.pecpayment.view.PaymentInitiator"
        android:process="ir.pec.mpl.process"
        android:screenOrientation="1"
        android:configChanges="0xb0"
        android:windowSoftInputMode="0x3">

        <intent-filter>

            <action
                android:name="pec.mpa.custom" />

            <category
                android:name="android.intent.category.DEFAULT" />

            <data
                android:mimeType="text/plain" />
        </intent-filter>
    </activity>

    <activity
        android:theme="@ref/0x01030010"
        android:name="com.google.android.gms.common.api.GoogleApiActivity"
        android:exported="false" />

    <receiver
        android:name="com.google.android.gms.measurement.AppMeasurementReceiver"
        android:enabled="true"
        android:exported="false" />

    <receiver
        android:name="com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver"
        android:permission="android.permission.INSTALL_PACKAGES"
        android:enabled="true"
        android:exported="true">

        <intent-filter>

            <action
                android:name="com.android.vending.INSTALL_REFERRER" />
        </intent-filter>
    </receiver>

    <service
        android:name="com.google.android.gms.measurement.AppMeasurementService"
        android:enabled="true"
        android:exported="false" />

    <service
        android:name="com.google.android.gms.measurement.AppMeasurementJobService"
        android:permission="android.permission.BIND_JOB_SERVICE"
        android:enabled="true"
        android:exported="false" />

    <receiver
        android:name="com.google.firebase.iid.FirebaseInstanceIdReceiver"
        android:permission="com.google.android.c2dm.permission.SEND"
        android:exported="true">

        <intent-filter>

            <action
                android:name="com.google.android.c2dm.intent.RECEIVE" />

            <category
                android:name="ir.resaneh1.iptv" />
        </intent-filter>
    </receiver>

    <receiver
        android:name="com.google.firebase.iid.FirebaseInstanceIdInternalReceiver"
        android:exported="false" />

    <service
        android:name="com.google.firebase.iid.FirebaseInstanceIdService"
        android:exported="true">

        <intent-filter
            android:priority="-500">

            <action
                android:name="com.google.firebase.INSTANCE_ID_EVENT" />
        </intent-filter>
    </service>

    <provider
        android:name="com.google.firebase.provider.FirebaseInitProvider"
        android:exported="false"
        android:authorities="ir.resaneh1.iptv.firebaseinitprovider"
        android:initOrder="100" />

    <meta-data
        android:name="com.google.android.gms.version"
        android:value="@ref/0x7f0b0007" />

    <meta-data
        android:name="com.android.vending.derived.apk.id"
        android:value="1" />
</application>

and here is my question: What is the meaning of this part?

android:name="org.telegram.messenger.ApplicationLoader"

I want to know if this software is a malware that pretends to be Telegram to steal people's information.

  • 1
    The "telegram" snippet doesn't appear anywhere in the section of manifest you posted. How does it relate? – Dan Hulme Mar 24 '18 at 20:01
  • I don't know why was the telegram part removed? I edited the question – Ameer Mousavi Mar 25 '18 at 8:15
1

android:name=" " This is where the creator of the application declares the name for the activity.

The name of an application is not the same as the package name, for example their could be two identical applications named Video Editor, but these applications need to have a unique package name to separate the two, Most people follow the android guidelines when naming a package, usually company.appname.com

The specific part you are asking about is declaring that your package uses a java file to handle it's work, I'll break it down

android:name="org.telegram.messenger.ApplicationLoader"   


org/telegram/messenger 

The directory in the application to get to ApplicationLoader.java

If you are editing the source code of your app you'll be able to follow this path to manage the ApplicationLoader.java file, It is necessary for your device to know what java is going to be run from each activity, one activity might be run at startup while another activity is started from a button press, the device needs to know what java is loading when, so you declare this in each activity. Not explained the best, sorry :)

Also i believe that android:name=".ApplicationLoader" Works fine. The package name is only necessary to define the first paths unless they're different

  • Thank you, what I understand from your answer : this app pretending to be Telegram in order to sniffing people activity in their telegram account, right? – Ameer Mousavi Mar 25 '18 at 12:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.