I have a malware infected android phone and I am suspicious that some of the binaries in system/bin/ and system/xbin/ are malware so I decided to dump the system and zipped the contents of bin and xbin into one file for testing using Virustotal, after scanning, some anti-virus engines indeed detect the zip to have malware but I can't view the specific files that caused that detection. Is there a way to do this in virustotal? or any other way to achieve this?
An easy way would be for you to unzip the files in a VM, create md5 hashes and submit the hashes to virus total. You'd know which files are malicious then.