Help identify this malicious code

[Slapwhacky]

I have for you two .txt files of code hidden in my files section of an iPhone that hard resets couldn't seem to stop. I found them when I transferred my photos and documents to my new android phone

I am not a programmer but I have been dealing with penetrations of multiple iPhone for the past few months and have gotten a new number and switched to android

Is there any way I can find out who is doing this? I still have the phone

I decided to post the files text here so you don't download them 😅

Name:unauth_SPTRemoteConfigurationPersistenceFetched.txt

S
Treatment*ios-feature-remoteconfiguration2remoteconfig_unauth_system_test@ß@
F
Treatment*ios-feature-unauth2remoteconfig_unauth_system_test@×Ô@œš‚™·0$364d40db-ea93-0230-fdf5-8a17e5202ef6

File 2
Name:SPTRemoteConfigurationPersistenceFetched.txt


Code:

3
*ios-feature-storylines2storylines_enabled@µS
*
�*ios-feature-auth2skip_auth_enabled@Êj
9
�*core-context-track-exts2enable_podcast_cta_cards@л@
K
White*ios-feature-remoteconfiguration2button_color_dummy_property@¿þ@
@
�*ios-feature-podcast2#video_episode_label_logging_enabled@Çþ@
B
�*ios-feature-podcastepisoderow2video_episode_label_enabled@Çþ@
?
�*ios-feature-podcastepisode2video_episode_label_enabled@Çþ@
R

noDescription*ios-feature-contentfeed2"episode_new_rows_description_style@üù@
D
*core-player2-enable_skip_played_episodes_no_rule_only_node@°A
:
*ios-feature-external-link2external_link_enabled@ÖA
@
�*!ios-feature-offlineesperanto-impl2auto_download_enabled@Ù…A
I
�*ios-feature-autodownloads2&podcast_quicksilver_onboarding_enabled@Ù…A
2
�*ios-autodownload-dal-impl2feature_enabled@Ù…A
@
�*ios-feature-yourepisodes2autodownload_hint_card_enabled@Ù…A
7
*ios-feature-concerts2concerts_virtual_events@í
<
�*core-connect-feature2connect_use_injected_http_dial@Ñù
B
WebGate*core-player-feature2context_resolve_connectivity@”ý
L
*ios-feature-promodisclosure2%promo_disclosure_context_menu_enabled@îÿ
<
*core-connect-feature2show_offline_devices_in_core@ü…
C
*ios-feature-a11yfeaturesusage2a11y_feature_usage_enabled@”Š
C
*ios-feature-performancemetrics2should_collect_app_metrics@¯"
@
Spotify*core-connect-feature2connect_ios_mdns_discovery@°J
A
�*core-connect-feature2$connect_device_capabilities_required@†c
B
*ios-feature-freetieralbum2album_offline_state_management@Û)
;
WebGate*core-player-feature2affinity_connectivity@¾Ž
b
�*ios-feature-siriintents2Bsiri_intents_add_collection_playlists_to_user_vocabularies_enabled@Ì:
>
�*ios-feature-freetierplaylist2measure_scroll_perfomance@¤J
S
*core-perf-metrics-feature2/should_flush_request_accounting_on_cold_startup@œK
D
*ios-feature-pushmessaging2 ios_push_message_feature_enabled@‹R
*
*ios-feature-ads2comscore_enabled@°W
=
*ios-feature-socialondemand2enable_on_demand_sharing@Z
>
*ios-feature-auth2#source_application_denylist_enabled@ëb
.
*ios-feature-ads2ads_feedback_enabled@Âf
F
*ios-feature-siriintents2$should_send_performance_measurements@ìX
.
*ios-feature-video2subtitles_enabled@¥•
9
*ios-feature-videocoordinator2subtitles_enabled@¥•
-
*core-ads2event_sender_for_ad_event@«—
;
*core-connect-feature2connect_strip_player_states@‚Þ
P
*ios-feature-videocoordinator2(subtitles_autogenerated_override_enabled@‹–
V
*&ios-feature-googleassistantintegration2$google_assistant_integration_enabled@
D
Tigger*ios-feature-remoteconfiguration2rc_aa_test_property@–›
*
*core-offline2offline2_over_http@Ч
B
*ios-feature-inappmessaging2inappmessaging_swift_enabled@Ó¡
H
*ios-feature-inappmessaging2"inapp_share_content_action_enabled@±¬
G
*ios-feature-inappmessaging2!inapp_share_entity_action_enabled@Ä´
9
*ios-feature-imageresolve2image_resolve_enabled@ñˆ=
f
*ios-feature-spotifyappprotocol2<inter_app_protocol_close_connections_on_end_of_stream_events@Ò=
O*ios-feature-alexaaccountlinking2$alexa_account_linking_nudge_duration@Æ’=
N*ios-feature-alexaaccountlinking2#alexa_account_linking_nudge_cadence@Æ’=
7
*ios-feature-partner2voice_assistants_enabled@Æ’=
2
*ios-feature-marquee2enable_marquee_swift@ŒJ
*
*
core-image2enable_image_resolve@‰Ž=
?
*ios-feature-share2"is_snapchat_canvas_sharing_enabled@̜=
1
�*ios-feature-marquee2suppress_impressions@ï=
D
*ios-feature-glue2)encore_larger_accessibility_sizes_enabled@·|
H
*ios-feature-glue2-encore_accessibility_bet_ax3_max_size_enabled@·|
A
*ios-feature-allboarding2onboarding_after_login_enabled@ =
:
*ios-feature-podcastepisode2dal_protobuf_enabled@é¤=
:
*ios-feature-yourlibrarypodcast2protobuf_enabled@é¤=
n
None*ios-feature-spotifyappprotocol2@inter_app_protocol_close_socket_on_connection_handler_disconnect@´¦=
[
Remove*ios-feature-externalintegration2*track_playback_mft_unplayable_policy_value@À¦=
C
*ios-feature-episodetranscript2episode_transcript_enabled@®¡=
H
Error*core-playlist-feature2"playlist_sync_events_logging_level@ͧ=
<
�*core-metadata-feature2audio_files_prefetch_critical@æ®=
K�*ios-feature-eventsender2*rate_limiting_rule_1_time_interval_seconds@¤µ=
K�*ios-feature-eventsender2*rate_limiting_rule_2_time_interval_seconds@¤µ=
K�*ios-feature-eventsender2*rate_limiting_rule_3_event_count_threshold@¤µ=
K�*ios-feature-eventsender2*rate_limiting_rule_3_time_interval_seconds@¤µ=
K�*ios-feature-eventsender2*rate_limiting_rule_1_event_count_threshold@¤µ=
:
�*ios-feature-eventsender2rate_limiting_drop_events@¤µ=
K�*ios-feature-eventsender2*rate_limiting_rule_2_event_count_threshold@¤µ=
2
�*ios-feature-ads2lasertag_experiment_dummy@ã’=
J
*ios-feature-playlistwithstories2live_streams_formatlist_enabled@À¬=
D
*core-playlist-feature2#allow_forced_playlist_cache_refresh@ð¸=
<
�*core-player2'enable_prefetch_metadata_proxy_fallback@‹¡=
b
*ios-feature-spotifyappprotocol28background_controller_should_act_on_all_playback_changes@¢³=
1
*core-bitrate2net_fortune_fetch_enabled@ªÄ=
9
*ios-feature-search2editorial_on_demand_enabled@ÄÎ=
J
*)ios-feature-podcastnewepisodenotification2settings_page_enabled@¤Ö=
@
*ios-feature-podcastepisode2ecm_episode_header_enabled@ŸÝ=
N
�*ios-feature-podcast21podcast_new_episode_notifications_tooltip_enabled@‰ç=
@
*ios-feature-podcast2!podcast_notification_bell_enabled@‰ç=
-
�*ios-feature-eventsender2optimize_ess@¸è=
>ð†*ios-feature-eventsender2full_ess_interval_seconds@¸è=
9
*ios-feature-videocoordinator2video_sai_enabled@Ýù=
F
*ios-feature-inappmessaging2 inappmessaging_swift_sdk_enabled@´è=
@
*ios-feature-inapppurchase2use_bundle_appstore_receipt@±€>
U
*%ios-feature-performancesdkintegration2$cold_startup_instrumentation_enabled@çÿ=
\
*ios-feature-performancemetrics22should_instrument_with_service_system_perf_tracker@çÿ=
<
*ios-feature-nowplaying2share_action_next_to_queue@¤„>
M
* ios-feature-nowplayingpodcastads2!podcast_ads_fetch_cta_eligibility@Á…>
<Ä*ios-feature-volume2record_mode_change_timeout_ms@Ý‘>
D
WebGate*core-player-feature2artistplaycontext_connectivity@í’>
#
�*core-ads2enable_ads_engine@Ή>
:
*ios-feature-nowplayingbar2quickplay_npb_enabled@™š>
:
*ios-feature-nowplaying2video_data_saver_enabled@é˜>
>
*ios-feature-datasaver2enable_data_concerns_settings@é˜>
M
*ios-feature-podcastpolls2)should_show_polls_feature_in_episode_page@õ£>

 

[HDFan]

I have been dealing with penetrations of multiple iPhone for the past few months

Please elaborate.

hidden in my files section of an iPhone

Are you talking about the files app on the iPhone, which gives you access to iCloud files?

 

[Slapwhacky]

Please elaborate.



Are you talking about the files app on the iPhone, which gives you access

 

[Slapwhacky]

These files were hidden somewhere in the phone and I only found them when I transferred my files and photos to my new android.



So I currently have my phone and I wiped and restored it without downloading apps just

icloud this time.

shut off all location and icloud services and backups. Then left it alone for the day I tuned on app privacy report.

I come back it this afternoon, camera light is on while phone is on the lock screen. I unlock, light goes out, no apps open, app privacy report shows unusual activity while the phone has been idle.

I turned it off.

Thoughts? I would ideally like to find someone to backtrace or analyze this phone

 

[ajf.350d]

Were the iPhones new to you? Are they supplied by your work?
Wondering if they have MDM config on them?
That would persist after a hard reset as well.

 

[Slapwhacky]

Were the iPhones new to you? Are they supplied by your work?
Wondering if they have MDM config on them?
That would persist after a hard reset as well.

No they were not, this had been occurring over multiple phones, as I broke two at work and got replacements

 

[Slapwhacky]

No they were not, this had been occurring over multiple phones, as I broke two at work and got replacements

Also I checking there is no MDM in the settings, so I believe it is not set up.

 

[DeltaMac]

No they were not, this had been occurring over multiple phones, as I broke two at work and got replacements

So, the phone belongs to the company, and you did not purchase or set up yourself?

 

[BrianBaughn]

Have you found an iPhone that doesn't have these files?

 

[ajf.350d]

No they were not, this had been occurring over multiple phones, as I broke two at work and got replacements

Sorry, was that no to they were not new, or no, they are not company supplied?