Package
com.samsung.android.knox.zt.framework
KnoxZT Framework
Package intelligence
Observed signing, permission, version and size signals from contributing devices - descriptive of that sample, not a verdict. These come from the v2 Package Search sync, which not every device has contributed to yet, so for some packages this detail is partial or not present at all.
- Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, and that single certificate is consistent across all 11 device profiles.
- Its largest observed manifest declares 16 permissions: 2 runtime (user-granted), 6 signature or system-level, 1 install-time and 7 vendor or uncatalogued.
- Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.
Declared permissions (16)
Largest permission set observed for this package. Text is Android's own published description where one exists; platform permissions Android does not document show their granted protection level (in grey) instead; vendor or unknown constants show the name only.
| Permission | Description |
|---|---|
CAMERA |
This app can take pictures and record videos using the camera while the app is in use. |
INTERACT_ACROSS_USERS |
Signature or privileged system permission. |
MANAGE_EXTERNAL_STORAGE |
Signature-level system permission, for platform-signed apps. docs ↗ |
MANAGE_USERS |
Signature or privileged system permission. |
NETWORK_SETTINGS |
Signature-level system permission, for platform-signed apps. |
POST_NOTIFICATIONS |
Allows the app to show notifications |
SCHEDULE_EXACT_ALARM |
This app can schedule work to happen at a desired time in the future. This also means that the app can run when you\u2019re not actively using the device. |
WAKE_LOCK |
Allows the app to prevent the phone from going to sleep. |
WRITE_SETTINGS |
Allows the app to modify the system's settings data. Malicious apps may corrupt your system's configuration. |
com.samsung.android.kfbp.BIND_SERVICE |
- |
com.samsung.android.knox.permission.KNOX_ANALYTICS_INTERNAL |
- |
com.samsung.android.knox.permission.KNOX_PROTECTED_KEYSTORE |
- |
com.samsung.android.knox.permission.SECURE_LOG_ACCESS_PROVIDER |
- |
com.samsung.android.knox.zt.framework.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION |
- |
com.samsung.android.knox.zt.permission.ACCESS_PROVIDER |
- |
com.samsung.android.security.permission.SAMSUNG_KEYSTORE_PERMISSION |
- |
Manage on devices
ADB commands for this package (the inverse of each is included so you can undo). Run from an authorised shell or wire the equivalent into your DPC. Verify on a test device first - this database doesn’t yet classify which packages are safe to change. --user 0 targets the current user; drop it (and use a privileged shell) to act device-wide.
/system, so Restore re-adds it (-k keeps app data)Seen on
Each record is a device profile (make + model + Android version). Each unique handset that syncs against a matching profile will increase the observations of a package, thereby increasing confidence that a package is expected to be on a device.
| OEM | Model | Android | Provenance | Observations | Last seen |
|---|---|---|---|---|---|
| Samsung | SM-A135F | Android 14 | OEM Samsung | 3 | 21 Jan 2026 |
| Samsung | SM-A137F | Android 14 | - | 1 | 17 Jan 2026 |
| Samsung | SM-A236B | Android 14 | OEM Samsung | 2 | 10 Apr 2026 |
| Samsung | SM-A266B | Android 15 | - | 2 | 21 Aug 2025 |
| Samsung | SM-A266B | Android 16 | - | 1 | 26 Jan 2026 |
| Samsung | SM-A346B | Android 14 | OEM Samsung | 1 | 4 Mar 2026 |
| Samsung | SM-A536B | Android 15 | - | 1 | 19 Jun 2025 |
| Samsung | SM-A556B | Android 15 | - | 1 | 1 Jul 2025 |
| Samsung | SM-A566B | Android 16 | - | 2 | 4 Nov 2025 |
| Samsung | SM-F721B | Android 15 | - | 1 | 9 Jul 2025 |
| Samsung | SM-F766B | Android 16 | - | 1 | 11 Nov 2025 |
| Samsung | SM-G766B | Android 15 | - | 1 | 17 Oct 2025 |
| Samsung | SM-G991B | Android 15 | OEM Samsung | 1 | 19 Apr 2026 |
| Samsung | SM-S721U | Android 15 | - | 5 | 5 Aug 2025 |
| Samsung | SM-S906B | Android 15 | - | 1 | 2 Jun 2025 |
| Samsung | SM-S908U | Android 16 | OEM Samsung | 1 | 2 Jun 2026 |
| Samsung | SM-S921B | Android 15 | OEM Samsung | 2 | 22 Jul 2025 |
| Samsung | SM-S921B | Android 16 | OEM Samsung | 1 | 13 May 2026 |
| Samsung | SM-S921U | Android 15 | - | 1 | 19 Jun 2025 |
| Samsung | SM-S926B | Android 16 | OEM Samsung | 1 | 14 Apr 2026 |
| Samsung | SM-S928B | Android 16 | OEM Samsung | 1 | 25 Jan 2026 |
| Samsung | SM-S928U1 | Android 15 | - | 1 | 12 Sep 2025 |
| Samsung | SM-S931B | Android 15 | - | 1 | 20 Sep 2025 |
| Samsung | SM-S931B | Android 16 | - | 1 | 23 Nov 2025 |
| Samsung | SM-S936B | Android 16 | - | 1 | 18 Dec 2025 |
| Samsung | SM-S937B | Android 15 | - | 1 | 25 Aug 2025 |
| Samsung | SM-S938B | Android 15 | - | 2 | 25 Aug 2025 |
| Samsung | SM-S942B | Android 17 | OEM Samsung | 1 | 25 May 2026 |
| Samsung | SM-T636B | Android 15 | - | 2 | 12 Oct 2025 |
| Samsung | SM-X716B | Android 15 | - | 1 | 27 Jun 2025 |
| Samsung | SM-X910 | Android 14 | - | 1 | 26 Jun 2025 |
| Samsung | SM-X910 | Android 15 | - | 1 | 12 Sep 2025 |
Known labels
Locale-aware display names seen in the wild.
| Label | Locale | Seen |
|---|---|---|
| KnoxZT Framework | en-us | 14 |
| KnoxZT Framework | en-gb | 13 |
| KnoxZT Framework | en | 7 |
| KnoxZT Framework | it-IT | 5 |
| KnoxZT Framework | nl-nl | 4 |
| KnoxZT Framework | en-nl | 3 |
| KnoxZT Framework | de-de | 2 |
| KnoxZT Framework | en-GB | 2 |
| KnoxZT Framework | es-ES | 2 |
| KnoxZT Framework | es-es | 2 |
| KnoxZT Framework | it-it | 2 |
| KnoxZT Framework | ru-ru | 1 |
| KnoxZT Framework | en-au | 1 |
| KnoxZT Framework | pl-PL | 1 |
| KnoxZT Framework | pl-pl | 1 |
| KnoxZT Framework | fr-fr | 1 |