A beginners fear of Android malware

Hello,

Based on your story: there is not much evidence that anything has caused serious harm to your devices, nor that you have been heavily targeted by attackers. As well as the actions you have taken to correct the situation, they look reasonable and without any particular flaws. Such as.. quite sufficient or even excessive.

But I will say right away that I have quite a bit of experience with mobile devices (Android in particular). In the context that I almost never use them as it is supposed (probably) to be done today. So, I use mainly cell phones for calls and SMS. And Android-based or Windows Phone devices are more like computers and mostly offline (and often without being tied to cellular networks). Therefore, many things are unknown to me or I simply don’t know how it could be there.

One thing still bothers me a bit. I read incoming SMS-messages etc. carefully, I don't understand how a file like that could have come through as an attachment, without me noticing it then, so how did it come to my phone and why did it have that phone number as a file name.

Since you mentioned that the scammers tried to spoof a valid phone number, and the "owner" of this number does not leave voice messages, it is possible that what was "left" by the scammers, either intentionally or accidentally, ended up in spam or quarantine automatically.

Also, some default settings/choices may replace 'original' SMS/MMS design to, so called, RCS. Which I suppose will work like a built-in 'messenger'-type; where RCS chats would have voice messages as an attachment, for example (?!).

For instance, even on my rather old device, I manually turned off the RCS option in the Google Messages app (I mean the option is even there). And if I look in spam and blocked, there are dozens of voice messages left from all sorts of 'callers' whose calls I don’t even remember. I don't know how they are stored. If they are stored at all for export or something like back-up or transfer.

So, why would anybody actually send me a file like that, for what purpose.

It is quite possible (given the discussions above in other comments) that this was an auto-call from a "scammer" or even a bank for advertising or promotion, the phone was not picked up and the call was forwarded to voicemail, where some "household" noise was recorded. Which can be explained by anything (I mean the nature of 'sound').

Since you suspected it to be ".amr" voicemail and after opening/launching it - your heard the content - so - it was likely such innocent 'stuff'. Another possibility is that this file is a "random" audio recording / audio note that you accidentally created during some "communication" with your local bank or in some connection. Since it is not entirely clear where exactly you found this suspicious file.

If scammers tried to make something (which would not describe the whole scheme or explain anything, though), maybe their idea would be to provoke sending some important information to your voicemail phone number. For example, if they had the ability to "check" your voice messages by spoofing your phone number and there if lacking of protection over it with your carrier. Then it would be beneficial for them if the "important" call from the bank would be missed (which in itself would be a form of login confirmation type of verification or something; which is not, basically, expected to be answered). But since I have not encountered such forms of verification, and also since it is so easy to invent any fantasy from any set-up, it is better not to think about this topic too much. Nevertheless, it is worth remembering and taking into account - that if all this looked suspicious, then there were reasons for that and it is better now to draw the right conclusions for future actions.

I think I can sleep a bit better now, and not be so worried about this any more.

Without disturbing your peace (because be calm), but simply to be even more attentive in the future..

.. what worries me (as the owner of a number of very old devices) is that it seems to me that devices like Android are sometimes subject to completely lethal consequences even without the user's knowledge or when doing the simplest things.

And I'm not talking about the well-known "commercial" spyware stuff, which can generally be reworked or reconfigured by any attacker (simply using ready-made techniques). But about all sorts of such unpleasant vulnerabilities and vectors as the old stories with just receiving MMS (Stagefright (bug)). Which could very well be trying to be "automatically" exploited by scammers by randomly sending it to people in the hope that they are using old devices and, let's say, trying to process it using vulnerable components.

There were also some relatively recent problems with ALAC format for most devices, but I don't remember it being widely covered. And your devices were most likely updated later than that (I mean, patched). So returning to the original summary - the actions taken to eliminate the consequences were good and there is a fairly close to zero presence of problems.

Thanks and sorry for the discussion.