How to Check an APK for Malware Before Installing (2026)

This is not only about banking apps and messengers — even a tool that promises to download videos or "speed up" your phone can arrive as an APK signed by someone other than who it claims to be. A VPN client, for example — LiMP VPN for Android — should only come from the official site or Google Play, never from a link in a chat message; that single habit removes half the risks below.

Why an APK is riskier than an app-store install

An APK (Android Package) is an app's installation file. When you install from Google Play, the store scans the file in advance, verifies the developer and signature, and future updates arrive through that same vetted channel. Sideloading — installing an APK directly, bypassing the store — removes that layer: the file can be modified, repackaged, or simply not be the app it claims to be.

According to Google, apps installed through internet sideloading contain more than 50 times more malware than apps on Google Play. That figure comes from Google itself, and the company has not published a detailed methodology behind it, so treat it as an indicator of scale rather than an exact ratio. This gap is exactly why Google is rolling out developer identity verification for installs on certified devices: it becomes mandatory starting September 2026 in Brazil, Indonesia, Singapore, and Thailand, with further regions to follow. For what this means in practice, see our piece on Android developer verification.

How real the threat is shows up in cases like the RemControl banking trojan: according to researchers, it spread via fake pages designed to look like a Google Play listing, while actually leading to a third-party APK disguised as an IPTV app. Victims saw a familiar store-like interface and had no reason to suspect the file was not coming from the real store.

Where to get an APK from: a trust ladder of sources

Not every way of obtaining an APK carries the same risk. Before inspecting a specific file, it helps to know where it came from in the first place.

The rule is simple: the further a source is from the developer itself, the more manual checks you need before installing — and often the right answer is simply not to install it at all.

Spotting a suspicious file before you even download it

Some red flags are visible before the file ever lands on your phone — just by looking carefully at the name, the link, and the context in which it arrived.

• A double extension in the file name, such as photo.jpg.apk or doc.pdf.apk — Android only shows what comes after the last dot, so the file looks like a photo or document in your downloads list.
• Unfamiliar package extensions: .apks, .xapk, .apkm — these are bundles installed through a separate installer app rather than directly by the system, adding an extra trusted party to the chain.
• File size noticeably different from what's listed on the app's official page.
• A message creating urgency: "update your bank app immediately", "your account is locked, install this APK to unlock it."
• A file arriving directly in a chat named something like "Bank-App.apk" or "Delivery-Tracker.apk" instead of a link to the official store.
• Shortened links and look-alike domains that resemble the official site but differ by one letter or a different domain extension.

Police and banking fraud units regularly warn that these APKs are sent through messaging apps disguised as photos, documents, or official bank and government apps — counting on the recipient opening the file without a second thought. If you're unsure whether the site you're about to download from is genuine, check it first — see our guide on spotting malicious and fraudulent apps.

Checking an APK's signature and SHA-256 hash

If the source raises any doubt at all and the file is already downloaded, the next step is a technical check of the APK itself, not just its name.

Verifying the hash

SHA-256 is a file's unique fingerprint: even a tiny change to the content completely changes the hash. Developers who care about security publish the hash next to the download link, either on their site or in GitHub Releases. You can compute your own file's hash like this:

• Windows: certutil -hashfile file.apk SHA256
• Linux: sha256sum file.apk
• macOS: shasum -a 256 file.apk

If the resulting string doesn't match the published hash character for character, the file has been altered since publication and shouldn't be installed.

Checking the signing certificate

Every APK is signed with the developer's certificate. The signature doesn't just identify the author — it also protects updates: Android only allows a new version to install over an old one if the signatures match. You can inspect the certificate fingerprint with apksigner verify --print-certs file.apk from the Android SDK Build-Tools, or with an on-device APK analyzer app that shows the signature directly on your phone.

If Android shows "App not installed" or a package-conflict error when you try to update an existing app from an APK, it almost always means the new file is signed with a different key — it isn't a genuine update at all. The right move isn't to uninstall the original app just to force the new one in; it's to figure out where that suspicious file actually came from.

Scanning an APK with VirusTotal and antivirus tools

VirusTotal runs a file through dozens of antivirus engines at once and shows a combined result. There are two ways to check: searching by an already computed SHA-256 hash (uploading nothing), or uploading the file itself. Hash lookup is useful when you'd rather not send the actual file to a third-party service — for instance, an internal corporate build that may contain personal data: an uploaded file becomes accessible to security researchers, along with anything personal inside it.

Read the result carefully rather than just glancing at the total count. The Details tab shows general package information and requested permissions, Behavior shows what the file does when run in a sandbox, and Relations shows which domains and IPs it talks to. A single detection labeled as a generic or riskware heuristic from a lesser-known engine often means a pattern false positive or a bundled ad SDK, not a genuine virus. It's a different story when several well-known vendors independently name the same specific trojan family — that's a strong signal not to install the file. VirusTotal is a decision aid, not a final verdict, which is why it's worth keeping a mobile antivirus on the device as a second, independent layer that checks the app even after it's already installed.

Which permissions in an APK should raise concern

You can review permissions before installing: on Android's own installer screen, in an APK analyzer app, or on a file's VirusTotal page under Details → Permissions. The core rule is that permissions should logically match what the app claims to do. If a "flashlight" or "calculator" app asks for contacts and SMS access, that's a clear red flag.

• Accessibility Service — grants an app visibility into almost everything on screen, including reading text from other apps and simulating taps. This is the channel most often abused to steal banking-app data.
• Display over other apps (SYSTEM_ALERT_WINDOW) — lets an app draw fake login screens on top of real ones, harvesting usernames and passwords.
• Read and receive SMS — the classic way to intercept one-time codes sent by a bank.
• Notification access — lets an app read the content of every push notification, including bank codes delivered via SMS or push.
• Device administrator rights — makes removal harder and can allow a factory reset or screen lock.
• REQUEST_INSTALL_PACKAGES — the ability to install other APKs on its own, without your explicit consent for each file.

For a deeper look at which permissions on already-installed apps count as risky and how to audit them, see our piece on dangerous app permissions. For how banking trojans specifically abuse some of these permissions to overlay fake screens, see Android banking trojan overlay attacks.

How to install an APK safely on Android

1. Check the file's source against the trust ladder above — the lower the trust, the more thorough the remaining steps need to be.
2. Check the file name and extension: rule out double extensions and unexpected package formats.
3. Verify the SHA-256 hash and, if possible, the signing certificate against what the developer publishes.
4. Scan the file with VirusTotal — by hash or by upload, depending on how sensitive the data is.
5. Review the requested permissions against what the app is actually supposed to do.
6. Grant "install unknown apps" only to the specific source (browser, file manager) you're installing from, install the app, then revoke that permission from the source afterward.
7. Keep Google Play Protect enabled and have it check the app again after installation.

Starting with Android 8, the install-unknown-apps permission is granted per source app rather than system-wide, which makes revoking it after a single install simple and side-effect-free. Android 13 and later adds another barrier — Restricted settings — which by default blocks newly sideloaded apps from being granted Accessibility access. If an app insists you go into settings and lift that restriction "to make a feature work," that's almost always a sign of a scam rather than a genuine need.

For files you're not fully confident about but still want to try, a reasonable compromise is installing them into a separate work profile or a second Android user, isolated from your main data and banking apps. If that isn't an option, or doubts remain too strong, the right call is simply not to install the file at all. For an extra layer of on-device protection, see our guide on Android's Advanced Protection mode.

What to do if a suspicious APK is already installed

If you notice unusual behavior after installing an APK — unexpected battery drain, ads popping up over other apps, unexplained card charges — act quickly and in the right order.

First, turn off internet access (Wi-Fi and mobile data) to cut the app off from its command server. Reboot into Safe Mode, where third-party apps don't launch, making removal easier. In settings, revoke the suspicious app's device-administrator rights and Accessibility access if granted, then uninstall it. After that, change your banking, email, and messaging passwords — but do it from a different, clean device, not the phone that's still under suspicion. Call your bank to flag possible compromise, run a full Play Protect scan, and if doubts remain, factory-reset the device. For a detailed breakdown of hacking indicators, see signs your phone is hacked.

It's worth understanding the limits of this whole approach: everything above applies to files you choose to install yourself. It doesn't protect against infection that happened before the device was ever turned on for the first time — a scenario covered in our piece on preinstalled malware on a new Android phone, where malicious code is baked into the firmware before the phone ever reaches a buyer.

What a VPN can and can't do here

A VPN doesn't scan files and isn't a substitute for antivirus software — it can't tell a clean APK from an infected one. Its role is different: when you download a file over public Wi-Fi at a café, airport, or hotel, a VPN encrypts the connection and protects the download from being swapped in transit — a man-in-the-middle (MITM) attack, where someone on the same network tries to replace the file you're downloading or redirect you to a fake download page. A VPN also hides which resources you're visiting from the network itself.

The VPN client itself follows the same rules as any other app: install it only from the official source — Google Play or the developer's website — never from a link on a third-party catalog. For how to do that correctly, see how to download a VPN safely, and for apps that pose as VPNs while actually being malicious, see malicious VPN apps. Every official LiMP VPN app — for Android, Windows, and Chrome — is listed on the LiMP VPN apps page.

Checklist: checking an APK in 5 minutes

• Download the file only from the developer's official site or a trusted app store.
• Check the full file name — watch for double extensions and unusual package formats.
• Compute the SHA-256 hash and compare it with the one the developer publishes.
• Scan the file on VirusTotal, by hash or by upload.
• Review the permission list and check it against the app's actual purpose.
• Grant install permission to a single source and revoke it right after.
• Make sure Google Play Protect is enabled and let it check the app post-install.
• Don't lift Restricted settings just because the app asks you to.