It's pretty had to give a list of malicious android app.
In general: always download appss from play store, Google check all these apps with an antivirus.
Furthermore some app can be open-source (generally it's in the description) but if you want a list you can get F-Droid. Nearly all apps exist in opensource version: OSMand (GPS), FaceSlim (Facebook), OpenTasks (ToDoList), QKSMS (sms app), Red Moon (blue screen filter), Syncthing (file synchronisation) etc...
As you have a rooted device, there are some apps that allow you to uncheck app permission (as Android 6) a little google search will give you results (you may certainly need BusyBox)
Also there is the excellent Xposed framework that propose (if I remember) some modules to get rid of some permission.
Be aware that sometimes disabling permission may block the app, just give back the permission to restore.
I'm sory I can't provide you more link cause I've got too low reputation.