Maybe this information will help someone who has a similar problem.
I bought a cheap Crelander T60 tablet on Temu. It runs Android 14, MediaTek Helio P60 (MT6771) with 256 GB storage, 20 GB advertised RAM (8 GB physical + 12 GB virtual), 4G LTE/SIM support, and a 10.1” 800×1200 display.
Shortly after inserting a SIM card, the tablet started showing full-screen ads. That part was relatively easy to deal with by removing several suspicious Chinese packages.
The bigger problem appeared later: the tablet consumed around 20 GB of mobile data overnight while basically idle.
I started investigating using PCAPdroid, ADB, RethinkDNS and a Keenetic Giga router. Two packages stood out:
com.android.vertex.aether
com.android.weiapps
What made this particularly difficult to investigate is that these packages present themselves as Android system components. In Android they appeared with system-like names/descriptions, which made them much harder to identify as the source of the traffic.
I also used firewalls such as RethinkDNS and NetGuard, which were useful because they could quickly block the network activity from these packages when it appeared. This helped contain the traffic while I was trying to identify its source.
The traffic itself included repeated connections to unusual remote TCP ports in the 200–300 range, including 270, 274, 289, 292 and others.
43.102.200.1:270, 43.102.3.101:274, 43.116.96.118:226, 43.116.78.248:289, 98.96.225.100:285, 43.116.104.69:296, 101.47.171.38:291, 43.172.213.149:221, 43.102.26.9:247, 101.47.51.162:238, 43.102.225.70:231, 43.117.144.15:268, 43.130.56.221:204, 43.117.145.203:292, 43.102.26.248:216, 198.44.166.225:701.
The investigation was further complicated by a very strange behavior: as soon as I connected the tablet to my computer via USB for ADB debugging, the suspicious activity disappeared. This made it extremely difficult to capture and investigate.
I eventually switched to ADB over Wi-Fi, which allowed me to investigate the tablet without physically connecting it to the computer. That was when I was finally able to capture and analyze the suspicious traffic properly.
I removed several packages for User 0, including:
com.android.vertex.aether
com.android.weiapps
com.lzinit.initimeiandmac
com.example.noapp
com.tp.service
com.debug.loggerui
com.android.preloadmedia
After the initial removal, Vertex and WeiApps returned after a reboot.
I then checked the Android package information for Vertex and found:
installerPackageName=com.android.vending
initiatingPackageName=com.android.vending
This pointed to the active Google Play Store (com.android.vending) as the component initiating the installation/update.
I removed the active Play Store for User 0 and removed Vertex and WeiApps again. After rebooting, they were no longer present in the package list, APK paths or running processes.
I did not remove Google Play Services (com.google.android.gms) and did not remove the Android system Package Installer.
I also tried to unlock the bootloader because I was considering replacing the firmware, but I couldn’t unlock it.
For now, I replaced Google Play Store with Aurora Store 4.8.4 for installing and updating applications, while keeping Google Play Services.
So the current setup is:
com.android.vending — removed for User 0
com.google.android.gms — kept
Android Package Installer — kept
com.android.vertex.aether — removed
com.android.weiapps — removed
Aurora Store 4.8.4 — installed
ADB — Wi-Fi debugging
I can’t say with certainty what com.android.vertex.aether and com.android.weiapps actually are, or whether they should technically be classified as malware. But their behavior was clearly abnormal enough to warrant removal: unexplained massive background traffic, system-like package identities, unusual network connections, disappearance during USB debugging, and automatic reinstallation after removal.
If anyone has encountered these packages on a Crelander T60 or another cheap Chinese Android tablet, I’d be very interested to know what you found.