finding the same thing on a friend's phone, it seems the malware is more advance than we think.
tried wiping the phone using recovery on this redmi2 it failed.
tried re installing clean ROM failed.
install TWRP and install the ROM, found out that the malware is patching itself into the ROM...