Check if Cerberus is installed
Cerberus will survive a Factory Reset if it was installed as a system app via root.

But nothing will survive flashing unless it infected the bootloader, which is hard enough that you can treat it as entirely improbable.