malware - How can I identify the cache if I see its name? One name is suspicious

If Device maintenance app is launched in Samsung S8, after pressing Clean Now button, storage cleanup briefly shows different apps, storage space of which is being cleaned:

System cache
OneNote
TopBuzz

Actual view visible for about 2 seconds:

I know that the last one is not among installed apps (when checking by name) so it must be part of some other app, but how can I find out to which app it actually belongs? No antivirus which I tried so far reported this as the malware. But maybe there is some system analyzer which shows similar cache ownership like the above app, but with more details?

(Or maybe there is another method how to find origin of that TopBuzz symptom.)

The phone is not rooted.

Answer

First, I have no affiliation with the app SD Maid.

Without root the app SD Maid can show you the emulated path and name of its public cache of user installed apps.

• Within the apps settings menu



• Go to AppCleaner


• then press the green circle at the bottom right corner to start the scan.


• Next press the circle on the right with the i in the center of it.

This will show the path and name of the apps public cache.

Edit: Thanks to darken who is the app developer whom suggested:

"Enable 'Show Systemapps' within in SD Maid's AppControl settings"

"After a scan just search for "buzz", if it is a distinct app it should find something."

"The search will look for both packagenames and app names of all types of apps except maybe instant apps if you don't have root."

I was also playing around with settings.

• 
  

  within the AppCleaner settings select show inaccessible items

  
  


• 
  

  next start a scan within the AppCleaner

  
  



• 
  

  scroll down and select the i if suspected app shows up

  
  

This will broaden the scan to show inaccessible app caches. This possibily will help narrow down the probable malicious app.

That is about the best you are going to be able to get without root.

Root access is need to access the apps private cache which is stored within /data/data/.