It seems that it may exist in your phone's firmware, according to recent news:
https://blog.avast.com/android-devices-ship-with-pre-installed-malware
Apologies if you already knew about this. They actually link back to this thread on that blog post. :D
See here...