Installing applications from unknown sources (APKfiles) is one of the riskiest steps for the owner of an Android device. According to Kaspersky, in 2023, more than 30% of mobile threats were distributed through fake or modified APKs, masquerading as popular games, utilities, and even banking applications. The problem is that viruses in APK they can not only steal data, but also turn a smartphone into part of a botnet, mine cryptocurrency, or block the device with a ransom demand.

This article is not about paranoia, but about real risks. Even if you downloaded a file from a “reliable” forum or through a Telegram channel, this does not guarantee its security. We will analyze 7 working methods of scanning —from online scanners to manual code analysis—and also tell you what signs should alert you even before downloading. Important: no single method provides 100% protection, but their combination reduces risks to a minimum.

Why the standard Google Play Protect scan does not save

Many users mistakenly believe that the built-in scanner Google Play Protect automatically blocks all threats. In practice, this works differently:

  • 🔍 Delayed database updates: Play Protect relies on virus signatures that are updated with a delay. New threats (so-called zero-day exploits) can remain undetected for weeks.
  • 📦 False triggering: The scanner often misses modified APKs (for example, hacked versions of paid applications) if they do not contain obvious malicious code.
  • 🚫 Limited analysis: Play Protect checks only installed applications, but does not scan APK files located in the device memory.

Moreover, according to research Check Point, 1 out of 5 malicious APKs passes Play Protect verification if attackers use code obfuscation techniques or dynamic payload loading. This means that even a “green” status in Play Protect does not guarantee security.

⚠️ Attention: If you have disabled Google Play Protect in the settings (for example, to save battery power), your device becomes even more vulnerable. To check its status, go to Settings → Google → Security → Google Play Protect.

Method 1: Online APK scanners - quick check without installation

The easiest way to check APK is upload it to a specialized online service. These tools analyze the file for known viruses, trojans, and suspicious permissions. Here are the top 5 proven platforms:

Service Advantages Disadvantages Link (domain)
VirusTotal Uses 70+ antivirus engines, shows detailed report Files >128 MB are not scanned, queues are possible virustotal.com
APKMirror Analyzer Checks the integrity of the certificate, compares with the original from Google Play Not all viruses are detected, there is no deep code analysis apkmirror.com
MetaDefender Scans for vulnerabilities (CVE), supports files up to 500 MB Interface is overloaded, slow processing metadefender.opswat.com
Koodous Analyzes the behavior of APKs in the sandbox, looks for hidden payloads Difficult for beginners, requires registration koodous.com
AndroTotal Specializes in Android, shows permissions and certificates The virus database is updated less frequently than VirusTotal andrototal.org

How to use online scanners:

  1. Download the APK to your device (but do not install!).
  2. Go to the scanner website (for example, VirusTotal).
  3. Download the file or paste its hash (SHA-256).
  4. Wait for the report (usually 1-5 minutes).
⚠️ Attention: Some online scanners may save downloaded files in their database. If the APK contains confidential information (for example, a beta version of a corporate application), use offline verification methods.
📊 How often do you install APKs from third-party sources?
Never
1-2 times a year
Once a month
More than once a week

Method 2: Local antiviruses for Android - deep analysis

If online scanners provide only a superficial check, then full-fledged antivirus applications analyze APKs more deeply: they check behavior in the sandbox, monitor network activity and compare the code with threat databases. The best options:

  • 🛡️ Bitdefender Mobile Security: Uses a cloud scanner with minimal load on the device Detects even modified APKs with changes. certificates.
  • 🔍 Kaspersky Internet Security: Checks files in real time, blocks phishing links in APK (for example, fake account login pages).
  • 📊 Malwarebytes: Specializes in adware and spyware, removes hidden modules in APK.
  • 🔐 ESET Mobile Security: Analyzes APK permissions and warns about suspicious ones (for example, access to SMS or geolocation for no reason).

How to check an APK through an antivirus:

  1. Install one of the applications above (download only from Google Play!).
  2. Open the antivirus and select the "Scan files" or "Check storage" option.
  3. Specify the path to the APK (usually this is folder Download or Files).
  4. Wait for the results. If the antivirus detects a threat, it will offer to delete the file.

Checked on VirusTotal (0 threats)

Local antivirus did not detect any viruses

The file was downloaded from official source (not torrent/forum)

APK permissions correspond to its functionality

The hash of the file matches the official one (if there is data)-->

Important: some antiviruses can false positive on modified APKs (for example, patched games). In this case, check the hash of the file with the original or check reviews on thematic forums (for example, 4PDA or XDA-Developers).

Method 3: Manually checking APK permissions and certificates

Even if the antivirus did not detect threats, you should do it yourself study what the APK requests and who signed it. You don’t need to be a programmer to do this - just a few tools are enough. permissions asks for the APK and who signed it. You don't need to be a programmer to do this - just a few tools are enough.

Step 1: View permissions

Use the application APK Analyzer (available on Google Play) or website APKMirror:

  1. Download the APK to APKMirror Analyzer.
  2. Go to the tab Permissions.
  3. Pay attention to suspicious permissions:
    • 📱 READ_SMS or SEND_SMS —if this not a messenger or banking application.
    • 📍 ACCESS_FINE_LOCATION —in games or utilities without geolocation functions.
    • 🔑 REQUEST_INSTALL_PACKAGES —allows you to install other APKs without your knowledge.

Step 2: Certificate verification

Fake APKs are often signed with unofficial certificates. To check:

  1. Use APKTool (for PC) or App Inspector (for Android).
  2. Extract information about the certificate from the section META-INF.
  3. Compare the certificate fingerprint (SHA-1 or SHA-256) with the official one (for example, on the developer's website).
    4. An example of a dangerous permission

    Permission android.permission.BIND_ACCESSIBILITY_SERVICE allows the application to read everything you enter on the screen (including passwords) and simulate pressing it frequently. use banking Trojans, for example Cerberus or Anubis.

    If the APK requests permissions that do not correspond to its functionality (for example, a flashlight asks for access to contacts), this is a reason to refuse installation. For comparison: the original Google Maps requests 12 permissions, and the fake version may require. 20+.

    Method 4: APK code analysis (for advanced users)

    If you are ready to delve into technical details, you can check the APK for malicious code manually. To do this you will need:

    • 💻 APKTool — to decompile the APK into readable code.
    • 🔎 JADX — to view Java code.
    • 📝 Text Editor (for example, Notepad++ or VS Code) — to search for suspicious strings.

Instructions:

  1. Decompile the APK from using APKTool: 
    apktool d your_app.apk -o output_folder
  2. Open the folder output_folder/smali and look for suspicious classes:
    • 🕵️ Classes with names like Bot, Injector, Root.
    • 🔗 Methods that send data to remote servers (look for HttpURLConnection or OkHttpClient).
    • 📱 Calling system commands via Runtime.exec().
  • Check the file AndroidManifest.xml for hidden services or receivers.
    • ⚠️ Attention: This method requires knowledge of Java/Kotlin and Android architecture. If you are not confident in your abilities, it is better to use online scanners or antivirus apps. An error in the analysis can lead to missing a real threat.
    💡

    Look in the APK code for lines with IP addresses or domains that do not belong to the official application servers. For example, if a domain Telegram domain occurs api.telegram.orgoccurs in the code, this is normal. And if there are links to some-random-server[.]xyz this is a reason to be wary.

    Method 5: Checking the reputation of the APK source

    Often the danger lies not in the file itself, but in that where did you download it from. Here are the red flags that should alert you:

    • 🚩 Forums and torrents: Files from Rutracker, The Pirate Bay or similar sites in 80% of cases contain modified code (even if it is a “clean” version).
    • 📥 Unofficial "mirrors": Sites like apkpure.com or apkmody.io often distribute pirated or infected versions of popular applications.
    • 💬 Telegram channels: Channels with “hacked” games (Mod APK) almost always add advertising SDKs or spyware modules to the code.
    • 📧 Attachments in letters/messages: APKs sent by email or in instant messengers are 99% likely to be phishing.

    Safe APK sources:

    • ✅ Official website of the developer (for example, signal.org for Signal).
    • ✅ APKMirror - checks the integrity of files and certificates.
    • ✅ F-Droid —a repository of open source software with verified code.
    • ✅ GitHub (official developer repositories only).

    Before downloading, check:

    1. Whether the hash (SHA-256) of the file matches the official one (if it published).
    2. Does the source have an SSL certificate (the address must start with https://).
    3. When the file was downloaded - a recent version or an outdated one (attackers often distribute old versions with vulnerabilities).
    💡

    Even if the source seems reliable, always cross the data: check the hash file, compare the size with the official version and read reviews on independent sites (for example, Reddit).

    Method 6: Sandbox for testing APK

    If you are not sure about the security of the APK, but really want to install it, use sandbox —an isolated environment where you can run the application without risk to the main system. Options: Sandbox: Virtual devices for testing. Minus - require a PC. data-i="195">Cloud sandboxes

    • 🖥️ Genymotion or Android Studio Emulator: Virtual devices for testing. The downside is that they require a PC.
    • 📱 Shelter or Island: Applications for creating an isolated profile on Android (work via Work Profile).
    • ☁️ Cloud sandboxes: Services like Any.Run or Joe Sandbox allow you to download an APK and see its behavior in real time.

    How to test in a sandbox:

    1. Install the APK in an isolated environment (for example, via Island).
    2. Launch the application and observe its behavior:
      • 📤 Does it send data to the network (use NetGuard or PCAPdroid to monitor traffic).
      • 🔄 Does it ask for unexpected permissions after installation.
      • 📱 Does it cause suspicious activity (for example, spontaneous opening of the browser).
  • If nothing suspicious happens within 10-15 minutes, you can try installing the APK on the main device (but still monitor it work!).
    • ⚠️ Attention: Some viruses are not activated immediately, but after a few days or after rebooting the device. The sandbox does not provide a 100% guarantee, but it reduces the risks.

    Method 7: Monitoring behavior after installation

    Even if the APK has passed all checks, monitor its operation after installation. Signs of infection:

    • 🔋 Increased battery consumption: Viruses often mine cryptocurrency or send data in the background.
    • 📶 Unusual traffic: The application transmits data even though you are not using it (check it). c Settings → Mobile network → Traffic usage).
    • 📱 Self-launch: APK opens without your participation or unknown notifications appear.
    • 💰 Money debits: Unexpected payments or SMS to short numbers.
    • 🔒 Device blocking: Requiring payment for “unlocking” is a sign of a ransomware (ransomware).

    Tools for monitoring:

    • 🛡️ GlassWire —monitors the network activity of applications.
    • 📊 Battery Historian —analyzes battery consumption.
    • 🔍 aLogcat —shows system logs (look for suspicious entries from your APK).

    If you notice something from this list:

    1. Uninstall the application immediately.
    2. Scan your device with an antivirus (Malwarebytes or Dr.Web).
    3. Change passwords for important accounts (especially if the APK had access to the browser or keyboard).
    4. If you suspect ransomware, disconnect the device from the network and contact antivirus support.
    💡

    If an APK requests access to Accessibility Service (special features), this is almost always a sign of malware. Such applications can intercept keyboard input, take screenshots and simulate clicks.

    FAQ: Frequently asked questions. about checking APK for viruses

    Can you trust an APK from the developer's website if it is not on Google Play?

    Yes, but with reservations. Some developers (for example, F-Droid, Signal) distribute the APK through their website Before installation:

    1. Check if the website domain matches the official one (for example, signal.orgrather than signal-apk[.]com).
    2. Compare the hash of the file with that published on the site.
    3. Use VirusTotal for additional verification.

    If the site looks suspicious (no HTTPS, errors in the text, aggressive advertising) - it is better not to download.

    What should I do if the antivirus detected a virus, but I have already installed the APK?

    Follow the algorithm:

    1. Delete the application via Settings → Applications.
    2. Run a deep scan with an antivirus (for example, Kaspersky in the "Full scan" mode).
    3. Check the list of installed applications for unknown ones (viruses are often disguised as system utilities).
    4. If the antivirus was unable to remove the threat, reset to factory settings (Settings → System → Reset).
    5. Change passwords for mail, banking applications and social networks.

    If the device is blocked by ransomware, do not pay the ransom! Contact in support of the antivirus - some viruses can be removed via ADB or Safe Mode.

    How to check an APK for viruses without the Internet?

    If you do not have access to online scanners, use offline methods:

    1. Install an offline antivirus (for example Dr.Web Light) and scan the file.
    2. Check APK permissions via APK Analyzer (works without the Internet).
    3. Use APKTool for manual code analysis (requires knowledge).
    4. Compare the hash of the file with the official one (if you have pre-saved data).

    For maximum security, download the virus databases for an offline antivirus in advance (for example, via Kaspersky Rescue Disk).

    Can an APK contain a virus if it is signed with an official certificate?

    Yes, but this is rare. An official certificate means that the file was not modified after it was signed by the developer. However:

    • 🔑 The developer could have intentionally added malicious code (for example, in case of account leakage or malicious intent).
    • 📦 The certificate could have been stolen or forged (for example, through a vulnerability). c Android App Bundle).
    • 🔄 Some viruses download malicious payloads after installation (through updates or network requests).

    Check not only the certificate, but also the behavior of the application after installation.

    What types of viruses are most often found in APKs?

    By data Avast for 2026, top 5 threats in APK:

    1. Adware: Intrusive advertising, redirection to phishing sites (for example, HiddenAds).
    2. Banker: Trojans for stealing banking data (Cerberus, Anubis).
    3. Ransomware: Encryptors blocking the device (LeakerLocker).
    4. Spyware: Spyware that steals SMS, geolocation, photos (Pegasus).
    5. Miner: Mines cryptocurrency in the background, overheating the device (Loapi).

    Most of them are disguised as games, hacked applications or utilities (for example, “memory cleaners”)).