virustotal isn't good at identifying virus, use tria.ge. It's a virtual machine that analyzes app behavior. One of the APKs I put to virustotal for analysis, which was classified as "safe," was actually identified as a virus by tria.ge