Suspicious new folder named .um in internal storage, google search says file is spyware

Question

I am running Android 7.0 in a Samsung Galaxy J7 prime phone. Today, while using the phone, I suddenly found a folder named obj in Internal storage/Android, that had never been there before. It had the timestamp of only a few minutes ago. The folder had more files inside, the path is this - Internal storage/Android/obj/.um/sysid.dat

There was a similar duplicate with the same timestamp in the following directory - Internal storage/Android/data/.um/sysid.dat

I did a google search, and a Dr. Web page as well as a Hybrid analysis page came up, both flagging a similar directory as a SMS spy app. The files were same, but the directory was a little different, as they were located on the sd card in the pages, while in my phone they are located in Internal storage and no such files on sd card. Here is the link - https://vms.drweb.com/virus/?i=15272609&lng=en

I don't know how these files got in, as I haven't installed any new apps in like forever, and also I'm very cautious while browsing, and when these files got created, I was browsing perfectly safe websites. Anyway, since the Dr. Web page had the spyware sample and said it was able to flag the file, I figured the antivirus could at least detect the malware, if not remove it (in case it was rooted in the system), and hence downloaded the Dr. Web Light app from playstore and ran both full and quick scans with it, twice. Did not detect a thing, despite having these file directories explicitly listed on their website analysis of the spyware. I would understand if it did not remove it, but since it has already analysed this malware sample, I would expect it to at least flag the file.

Also ran full scans with Norton, Kaspersky, Sophos, Zelmana and F-secure (all free versions except Norton and Zelamana which gave Premium trial versions), none of them even detected anything.

Apart from the Dr. Web and Hybrid Analysis pages, there is no more information about this on the Internet, except a lonely reddit thread which point back to the same aforementioned pages.

Can anyone guide me in the right direction here? Anyone happen to know about this particular incident? What should I do? Factory reset? Firmware flashing? It will probably take me a couple days to do either because I have to back up personal documents, till then, should I refrain from using the phone? Turn off data connection? Or shut the phone off altogether? Not make any calls or send any sms? I only have this one phone, I'm signed into every which thing from this, and I receive and make calls and messages daily.

I was blindsided by this, so I have to back up my personal files and chats to a USB first, which again, I'm worried, might get infected from being plugged into the phone and later while I restore the backups to the clean phone, causes reinfection.

Any suggestions as to how I can back up safely and what I should actually do at this point to limit any further damage till I wipe the phone?

Please help me out, really worried and still using the phone as I don't have access to anything else. Some detailed information will be very appreciated.

Answer 1

If you only install apps from Google Play, the chances of you picking up a phone virus are slim to none. Google scans all apps added to Google Play for malicious behavior and removes offenders. While some slip through the cracks, you’re very unlikely to install a virus app from the Play Store.

Installing from other sources is entirely different. Downloading apps from random websites, especially “cracked” apps (paid offerings illegally provided for free), is a great way to pick up malware. If you chose to sideload apps, make certain that you trust the location you download them from. The Play Store is home to dozens of Android virus removal apps. However, most of them are bloated and want you to pay for features you don’t need. However, there are a few worth using.

One of the most trusted names in desktop security, Malwarebytes also provides an Android app.

The free version scans your phone for malware and removes any threats it finds. It also has an audit feature for app permissions, so you can keep track of what each has access to. And it doesn’t have ads either.

However, this doesn’t mean every app on Google Play is beneficial. Scam apps might take your money for nothing, and many free apps abuse phone permissions to steal your data. But those are separate concerns from Android viruses.

Like on other platforms, common sense will help you avoid a virus. Don’t download from shady websites, try to avoid tapping on ads, and keep an eye on app permissions.

Any suggestions as to how I can back up safely and what I should actually do at this point to limit any further damage till I wipe the phone?

See this link below:

How to back up your Android phone

Backing up most of your data is actually pretty easy with Google, and it has gotten far easier over the past few years. Unfortunately there isn’t yet a one-stop backup method for Android phones through Google, but there are ways to backup different types of data. Here’s how to backup your data with Google. If you’re not already using Google Photos, you should be. The service automatically backs up every photo and video you take to the cloud, so you’ll never have to manually backup your media ever again. If the Photos app isn’t already on your phone, you can download it here. Once it’s installed, you’ll need to make sure Photos is set to automatically backup your files. Here’s how to do that:

Open the Google Photos app
In the menu, head to Settings
Tap ‘Backup & sync’
Make sure the switch is turned on

If you’d like to keep the original quality of your photos, you can, but it will count against your Google Drive storage. Here’s how to check your Google Photos upload quality:

Open the Google Photos app
In the menu, head to Settings
Tap ‘Backup & sync’
Tap ‘Upload size’
Choose the option you’d like

Google Drive lets you store your other files in the cloud, which means they’ll be accessible from any connected device. To manually upload folders and files, follow these instructions:

Download the Google Drive app, if you don’t have it already
In the app, press on the ‘+’ button
Press ‘Upload’
Select the file(s) you’d like to backup
That’s it!

Settings and apps

To backup your phone’s settings and apps, you’ll want to use Android Backup Service. This service essentially backs up the apps you use and the settings that you have selected in most Google apps, making it easy to restore those settings on a new phone. For a complete list of what gets backed up with Android Backup Service, head here. Otherwise, follow the instructions below to activate it:

Open your smartphone’s Settings app
Tap on ‘Backup & reset’
Press ‘Backup account,’ and add your account, if it’s not there already

And that’s it! Your device should be pretty much all backed up now. Unless, of course, you want to use a third party service instead of Google’s own.

Answer 2

With those apps not detecting a single thing I already smell an APT(Advanced Persistent Threat) actor behind this. A good reason why they don't detect it is possibly because they're using a well-known detection evasion technique called obfuscation but that's just an assumption.

I highly advise the following:

1. Get a new clean device asides from this thing.
2. Before using it, I also highly advise for you to have your Phone number changed before using the clean device as you said you use Cellular data. Lookup "SS7 Vulnerabilities" for information on how vulnerable text messages, calls, and anything related to your phone number are.
3. Install 1.1.1.1: Faster & Safer Internet from Google Play Store and continue daily life as you work to solve this problem.
4. If you can get yourself a VPN then get one and I highly advise against using free VPN as most of those free VPN apps usually lurk with malware as well either put in by the author or they were hijacked which allowed threat actors to hide malware inside the app.

I have a bunch of comments and points posted in your other InfoSec question for you to refer to and follow to get to a hopefully nice resolution to this problem.

This looks being real-paranoid but it's the only way to be sure. Refer to this link for understanding of "Nuke it from orbit" security meme.

Lastly, knowing the level of danger that is lurking in your old phone right now, I highly advise against attaching a USB to it as USB is really a broken, vulnerable standard even up to this date that never gets old as a de facto way of spreading malware. The reason for this is because USB is "Universal" and these high levels of freedom are heavily utilized by hackers and the like which is pretty much the reason why I never use USB to share files with other people now.

Answer 3

It is from apps that use umeng the biggest data analytics company

Delete SHAREit,TikTok or Xender or any Chinese app and try to see if it comes back I know this is 3 years old but nobody really answered your question right and not it isn't malware just typical "data for money" apps like how Facebook and Whatsapp work

Answer 4

These folders are downloaded from time to time, for me I disable data connection for download app (from setting-apps-all apps-download). I know it is hassle as you have to turn back on every time you want to download something but at least you are free from those annoying folders/files.