How do I know an official Malairte download is genuine?

Reach the official Malairte site yourself by typing the address or using a saved bookmark, never by clicking a link someone sent you. On that official page, find the published checksum, usually labelled SHA-256, and the download. After downloading, generate the checksum of your file using your operating system tools and compare it character for character with the official value. If a cryptographic signature is also offered, verifying it confirms the file came from the project. If the checksum matches, the file is intact; if it does not, delete it and download again. This routine defeats tampered and swapped files.