Can root viruses cause IMEI / EFS corruption?

[Android Central Question]

I have a Samsung S6 that stopped connecting to mobile networks out of the blue. After lots of troubleshooting, discovered that the IMEI number had been corrupted to 35000...0006 and figured out that this means that it has been corrupted.

I bought the phone new last summer from a shop that turns out not to be an authorized retailer. I tried calling Samsung to see if they would repair it under warranty since I've only had it 9 months, but when they had me enter into Odin mode, it turned out the phone had been rooted. I have not rooted the phone. I called the shop where I bought it (which seems reputable) and they said they would not have rooted it.

I confirmed that it is rooted using Rootbeer Sample, Root Checker, and Trend Micro Mobile Security.

Of all the tests that Rootbeer runs, the tests that give results indicating having been rooted are : SU Binary, SU Exists, Root Native, and Selinux Flag Enabled.

As I said, I've never rooted the phone. I've never installed software that wasn't from the google play store. I read about a couple of viruses from 2016 that were known to be able to root phones. And after dealing with this for a couple of days, I recall that I did recently have a brief issue with automatic ads coming up within Chrome, but this seemed to go away after clearing Chrome's Cache.

I understand that physical damage could cause the IMEI corruption, but there hasn't been anything like that that I'm aware of. Given the unexplained Rooting of the phone, one working hypothesis is that a virus tried to root the phone, and somehow failed, causing the IMEI corruption. Is that a ludicrous idea? Has that been known to happen?

I would be really grateful for any advice or more information to look into.

Super bonus question: all of this happened shortly before beginning a new position at a human rights organization. It's enough to make someone a little paranoid. Could sloppy surveillance both remotely root a phone and cause IMEI corruption?

Veering towards the improbable maybe, but what else are forums for?

 

[Mooncatt]

Sounds like this phone wasn't "new" when you bought it. My guess is the phone was used and rooted (along with whatever else is going on) by a prior user, then acquired by the dealer you bought it from. The other possibility being it was used and someone else rooted it (the dealer, a refurbisher, or other third party). If you paid full price for a brand new phone from a non-authorized dealer, that is definitely not a reputable dealer. I'd try to get a refund if possible, but even if that's not possible, I would cut my losses.

Because it's rooted and has other questionable issues going on, I'd stop using it and flat out replace the phone. If you buy a new one, only get them from an authorized dealer. If you buy used, make sure you check for root before making the purchase (meaning an in person purchase). I would also use another phone or computer to change all of your passwords on all of your accounts in case there was a key logger or other malware installed on this phone.