How to Check an APK for Viruses Before You Install It

An APK is the install file for an Android app. Most people get apps from the Google Play Store, but sometimes you download an APK directly from a website. To check an APK for viruses, download it only from the official source, scan it on VirusTotal, compare its checksum, review the permissions, and let Google Play Protect scan it. If a file fails any of these checks, do not install it.

This guide shows each step in plain language, plus the warning signs of a fake or dangerous app.

What is an APK and why is it risky?

APK stands for Android Package. It is the file type Android uses to install apps, much like an .exe file on Windows. When you get an app from Google Play, Google checks it first. When you download an APK from a website, nobody has checked it for you.

Installing an app from outside the Play Store is called sideloading. It is not always bad. Developers share beta versions this way, and some apps are not in the store in your country. But it also gives bad actors a way to hide malware inside a fake copy of a popular app.

Malware inside an APK can:

• Steal passwords and banking information
• Read your text messages, including login codes
• Show endless ads or take over your screen
• Sign you up for paid services without you knowing
• Use your phone to send spam or run hidden tasks
• Lock your files and ask for money

Step 1: Get the APK from a trusted place

The best way to avoid a virus is to start with a clean file. Ask yourself where the file came from.

Safer sources:

• The official website of the app's developer
• Google Play Store (no APK needed)
• F-Droid, a well known store for open source apps
• A phone maker's own app store, such as the one on a Samsung phone

Risky sources:

• Random download sites with big "Download" buttons and lots of ads
• Links sent in text messages, emails, or social media comments
• Pirated copies of paid apps and games
• "Mod" or "unlocked" versions with free coins or premium features
• Files shared in chat groups

Step 2: Scan the file with VirusTotal

VirusTotal is a free website that checks a file against dozens of antivirus tools at once. Its documentation says it can scan any type of file, including Android APKs.

1. Go to virustotal.com on your phone or computer.
2. Choose File and upload the APK. You can also paste the web link where you found it.
3. Wait for the scan to finish.
4. Read the results. If many engines mark the file as malicious, do not install it.

A few tips for reading the results:

VirusTotal's own blog says its Android tool is not a replacement for an antivirus product, just a second opinion. Use it as one step, not the only step.

Step 3: Check the file's checksum

A checksum is a long string of letters and numbers that works like a fingerprint for a file. If someone changes even one small piece of the file, the checksum changes.

Many developers post the SHA-256 checksum for each download on their official site. To check it:

1. Find the checksum on the developer's website.
2. Get the checksum of your downloaded file. On a computer, you can do this with a free tool. On Windows, open Command Prompt and type certutil -hashfile yourfile.apk SHA256. On a Mac or Linux, type shasum -a 256 yourfile.apk.
3. Compare the two. They must match exactly.

If they do not match, the file was changed or damaged. Delete it and download again from the official site.

If the developer does not post a checksum, you can still use this trick: upload the file to VirusTotal and see if the same file hash was already scanned by others.

Step 4: Read the app's permissions

Permissions tell you what an app wants to do on your phone. A flashlight app should not need your contacts, and a calculator should not need to read your text messages.

Before you install, check what the app asks for. After you install, you can see the list in Settings, then Apps, then the app, then Permissions.

Warning signs include:

• SMS or call log access for an app that has nothing to do with messages
• Accessibility service access for a simple game or tool. This can let an app see and control your screen.
• Device admin access, which can make the app hard to remove
• Display over other apps, which some bad apps use to trick you
• Contacts, location, and microphone all at once for a basic app

If an app asks for far more than it needs, skip it.

Step 5: Turn on Google Play Protect

Google Play Protect is built into most Android phones. Google says it scans apps for harmful behavior when you install them and also checks your device regularly. It also scans apps that came from outside the Play Store.

To check that it is on:

1. Open the Google Play Store app.
2. Tap your profile picture at the top.
3. Tap Play Protect.
4. Make sure it is turned on, then tap Scan.

If you often install apps from other places, Google suggests you also turn on Improve harmful app detection. This lets Play Protect send unknown apps to Google for a check.

Play Protect may show a warning that says "Blocked by Play Protect" or "Harmful app." Take it seriously. Do not choose "Install anyway" unless you are certain the app is safe.

Step 6: Allow installs only when you need to

To install an APK, Android asks you to allow Install unknown apps for the app you used to download the file, such as your browser or file manager. This is a per-app setting.

Good habits:

• Allow it only for the one app you need, such as Chrome.
• Install the file.
• Turn the permission back off right away.

You can find the setting under Settings, then Apps, then Special app access, then Install unknown apps. The exact path varies by phone brand.

Step 7: Watch how the app behaves

After you install, keep an eye on your phone for a few days. Warning signs of a bad app:

• Pop-up ads when you are not using the app
• Battery drain or a phone that gets hot for no reason. See our guides on phones that overheat and why a phone restarts by itself.
• Extra data use in the background
• New apps you did not install
• Strange charges on your phone bill or bank card
• Text messages you did not send
• Your phone slows down a lot

If you notice any of these, remove the app right away.

How to spot a fake app

Fake apps copy the look and name of popular apps. Check these things:

• The package name. A real app has a package name tied to its company, like com.company.app. A fake may have a slightly different spelling.
• The developer name. It should match the company that makes the real app.
• The file size. A game that should be 500 MB but is only 5 MB is a warning sign.
• Spelling and grammar. Poor writing on the download page can signal a scam.
• Too many ads or pop-ups on the download page.
• Pressure to act fast, like "limited time" or "your phone is infected."

What to do if you installed a bad APK

Act fast if you think you installed a harmful app. Google's help page for removing malware suggests a path like this:

1. Turn on airplane mode to stop the app from sending data.
2. Restart in safe mode if you cannot find the app. Safe mode turns off apps you added.
3. Uninstall the app in Settings, then Apps. If the Uninstall button is grayed out, check Device admin apps in security settings and remove its admin rights first.
4. Run a Google Play Protect scan.
5. Change your passwords for email, banking, and social media from a different, clean device.
6. Turn on two-step verification on your important accounts.
7. Check your bank and card statements for charges you do not recognize.
8. Factory reset if the problem does not go away. Back up photos and files first, but do not restore apps from the backup.

If you shared banking details or card numbers, call your bank right away.

Is it ever okay to use an APK?

Yes, in some cases:

• You are using an official beta or a version the developer shares directly
• The app is not available in the Play Store in your country, and you downloaded it from the maker's own website
• You use an open source app from F-Droid
• You are a developer testing your own app

In each case, still follow the steps above. A few minutes of checking can save you from a big headache.

Keep your phone clear of junk

Many people end up looking for APKs because their phone is full or an app is missing. If your phone has no space for new apps, see how to free up storage when your phone says it is full.

The bottom line

Treat every APK as unchecked until you prove otherwise. Download from the official source, scan the file on VirusTotal, match the checksum, read the permissions, and keep Google Play Protect on. Never install cracked or modded apps, and turn off "Install unknown apps" when you are done. If a phone starts acting strange after an install, uninstall the app, scan with Play Protect, and change your important passwords.