Hi,

Based on your VirusTotal screenshot, I would not immediately assume the APK is malicious, but I also wouldn't automatically trust it.

From the screenshot:

• 2 vendors detected it out of dozens of antivirus engines.

• The detections are:

  • AhnLab-V3: PUP/Android.Agent...

  • Symantec Mobile Insight: AdLibrary:Generisk

• Every other major engine (Bitdefender, Avast, Avira, ClamAV, CrowdStrike, etc.) reports Undetected.

A detection rate this low often points to one of two possibilities:

1. False positives (quite common for Android APKs).

2. An app containing advertising, analytics, or tracking SDKs that some vendors classify as potentially unwanted rather than outright malware.

About "AdLibrary"

AdLibrary usually means the antivirus found an advertising SDK inside the app. That is not automatically a virus.

Many free Android apps including video editors include:

• advertising SDKs

• analytics SDKs

• crash reporting

• background services for notifications or syncing

Some security vendors flag these as "AdLibrary" or "Riskware" because they can collect usage data or display ads.

Is it normal that it stays running?

Yes, it can be.

Android apps can keep background processes alive for reasons like:

• handling notifications

• checking for updates

• media processing

• analytics uploads

• maintaining cached resources

Simply swiping an app away from Recent Apps does not necessarily terminate all of its background services.

That said, if CapCut is constantly running even when you haven't used it for a long time, that's more of a privacy or battery concern than proof of malware.

The most important question: Where did the APK come from?

This matters much more than the VirusTotal score.

• Official CapCut website or Google Play: low risk.

• APKMirror: generally considered reputable because they verify APK signatures.

• Random APK site or Telegram channel: much higher risk. Modified APKs are common.

A legitimate CapCut APK downloaded from an official source should have a valid signature matching the publisher.

What I would recommend

• If the APK came from an official source, 2/60+ detections alone would not worry me.

• If it came from an unofficial APK site, I'd be much more cautious, regardless of the low detection count.

• Check the Permissions the app requests. If a video editor is asking for unrelated permissions (SMS, phone calls, accessibility, etc.), that's a red flag.

• Monitor battery usage and network activity. Excessive background activity without explanation deserves investigation.