AvarionX combines local malware scanning, optional hash-based cloud intelligence, download monitoring, DNS filtering, APK analysis, and Guardian Mode for ransomware-style behaviour detection.
AvarionX Security is an Android antivirus built around user privacy.
It can scan files and APKs directly on your device, monitor new downloads, check known malicious domains, and use optional cloud intelligence for hash lookups. The app does not use ads, analytics, or paid protection tiers.
Cloud checks are optional. When enabled, AvarionX sends file hashes for lookup, not the file contents.
| Layer | What it does |
|---|---|
| VX-TITANIUM | Local malware scanning engine for files and APKs. |
| VTTI Cloud | Also known as Titanium Cloud. A proprietary cloud Intelligence Platform, including hash checking for AvarionX, and sample analysis for full files |
| Real-Time Protection | Monitors new downloads and recently added files. |
| Guardian Mode | Watches for ransomware-style file behaviour. |
| APK analysis | Checks installed or selected APKs for suspicious indicators. and creates a detailed report |
AvarionX Antivirus (CS Security) operates through a multi-layered detection pipeline powered by VX-Titanium.
- Cloud Hash Layer: A fast check on an extremely large historical and current corpus of over 200 million unique malware hashes
- Hash Layer: Comparing both SHA256 and MD5 fingerprints against known malware lists
- Signature Layer: Custom byte signitures checked against apk containers, dex and native libraries.
- Heuristic Layer: Machine learning based behaviour analysis for APKs
- SIM (similarity engine): A custom algorithm tht calculates the similarity of an uknown file to known malware families.
AvarionX Security includes a dual ML system named ML+
- Legacy MUniverse Tag: Suspicious applications that meet the scoring system's requirements are dubbed with a MUniverse (Malware Universe) tag in app versions 4.0.8x and below
- Current versions use an upgraded heuristics model, with the tag: Andr/VXgen2
By utilizing shizuku, Guardian Mode can monitor app behaviour that android would normally keep out of reach. When an app starts changing files, AvarionX monitors it, assessing the likelihood on destructive behaviour. Guardian Mode is currently focused on ransomware-style behaviour. More behaviour categories will be added in future updates.
 Home screen |
 Features list |
 Scanning mode |
 APK Analyser |
Scanning mode |
APK Analyser |
 Settings Screen |
AvarionX is designed to avoid unnecessary data collection.
- No advertisements
- No tracking or analytics
- No HTTPS traffic decryption
- No content inspection
- No file uploads for cloud checks (unless 'Share Malicious APKs' is turned on)
- Hash-only cloud lookups when VTTI is enabled
- Local scanning works offline
Whilst AvarionX can detect thousands of families, it is best at known families within VTTI. These can be explored at: MalDex
