How to check APK for viruses in Android: a complete guide 2026

How to use VirusTotal:

1. Go to the site and click Choose File.
2. Download APK (maximum 650 MB).
3. Wait for analysis (1-3 minutes). Pay attention to the tabs:
   • Detection — list of antiviruses that found threats.
   • Details — permissions, certificates and hash sums.
   • Relations — connections with other malicious files.

Caution: some legitimate applications (for example, Lucky Patcher or GBWhatsApp) may be flagged by antivirus software as “potentially dangerous” due to code modification. In this case, read the description of the threat - often it is a false positive..

Method 3: Antiviruses for Android with APK scanning

Install a specialized antivirus that scans APK Before installation. The best options:

How to check APK through an antivirus:

1. Open the antivirus and select Scan file (or Check APK).
2. Specify the path to the downloaded file.
3. Wait for the result. Pay attention to:
   • Name of the threat (for example, Android.Trojan.Spy).
   • Recommendations (remove/disinfect/ignore).

⚠️ Attention: Some antiviruses (for example, Avast) themselves collect user data. Before installation, check the antivirus permissions in Google Play —if it requests access to SMS or geolocation for no reason, it’s better to choose another.

Method 4: Manually checking permissions. APK

Even if the antivirus did not find any viruses, study what permissions the application requests. To do this:

1. Install APK Analyzer (free in Google Play).
2. Open the downloaded APK in it and go to the tab Permissions.
3. Pay attention to suspicious permissions:
   • 📞 READ_SMS / SEND_SMS — can send paid messages.
   • 📍 ACCESS_FINE_LOCATION — tracks your location.
   • 💳 BIND_ACCESSIBILITY_SERVICE — can intercept password entries.
   • 📷 CAMERA + RECORD_AUDIO — record video/audio without knowledge.

Example: if the APK of a simple flashlight asks access to CONTACTS or CALL_LOG, this is a clear sign of spyware. Compare the permissions with the original application in Google Play (section About this app → App permissions).

adb shell dumpsys package your.package | grep "permissions"

Method 5: Checking the APK through the Android emulator (for experienced ones)

If you are not sure about the security of the file, test it in an isolated environment - Android emulatorThis will protect your main phone from infection.

Instructions:

1. Install BlueStacks or Genymotion on PC.
2. Create a new virtual machine (without synchronizing with your Google account!).
3. Drag the APK to the emulator window and install it.
4. Launch the application and watch behavior:
   • 🔄 Does it open a browser or advertisement on its own?
   • 📤 Sends data to the Internet (check via Wireshark)?
   • 🔋 Quickly drains the battery (in the emulator this can be seen by the load on the CPU)?

The advantage of the method: the virus will not gain access to your real data. Disadvantage: it requires time and skills in working with emulators.

Method 6: Analyzing the APK code (for developers)

If you are familiar with programming, you can decompile the APK and study its code. this:

1. Use JADX or Apktool for decompilation:

apktool d your_file.apk

2. Examine the files in the folder smali (low-level code) or res (resources).
3. Pay attention to:
   • 🔗 Suspicious URLs (for example, sending data to hxxps://some-random-site[.]ru).
   • 📦 Unknown libraries (for example, libsec.so no description).
   • 🔑 Hard-coded API keys or passwords (may indicate a botnet).

An example of dangerous code (from a real virus Anubis):

// Sending an SMS to premium number
SmsManager sms = SmsManager.getDefault();
sms.sendTextMessage("5556", null, "START 123", null, null);

If you are not a developer, it is better to skip this method - there is a high risk of missing a threat or misinterpreting the code.

What to do if the virus is already installed

If you have installed an infected APK, act quickly:

1. Disconnect the Internet (airplane mode) is will stop the transfer of data to attackers.
2. Uninstall the application via Settings → Applications.
3. Scan your device with an antivirus (for example, Malwarebytes).
4. Reset permissions for all applications:
   • Go to Settings → Applications → ⋮ → Special access.
   • Disable access to SMS, contacts, geolocation for unknown applications.

If a virus has blocked the phone or requests a ransom:

• 🔄 Reboot into Safe Mode (hold the power button → “Reboot in Safe Mode”).
• 📱 Reset the settings to factory settings (Settings → System → Reset).
• 💻 Connect your phone to your PC and scan via Dr.Web CureIt!.

⚠️ Attention: Do not pay the ransom! Even after payment, the files may remain encrypted, and your data will end up in the scammers’ database for new attacks.

FAQ: Frequently asked questions about APK verification