Suspicious
Single tier-1 detection on an unsigned research-tool ELF with no corroboration or runtime indicators.
180998238ef3239d9b…19e6992949The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The detection profile shows a classic single-engine outlier on an ELF binary whose filename explicitly signals a reverse-engineering tool. No tier-1 family consensus exists, behaviour data is absent, and external intelligence sources returned zero hits. Unsigned status and lack of RAG matches leave the file in mixed-signals territory rather than a clear malicious or safe classification.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines.topDetections[0]: Microsoft tier1 'Trojan:Script/Wacatac.B!ml' (single tier1 flag, no family consensus)
filenameAnalysis.looksLikeResearchTool=true and triggeredHeuristics[0].rule=filename_research_tool
prevalence.classification=medium (13 uniqueSources, 23 submissions) and file.ageDays=13
signing.signed=false and externalIntel.yaraify.ruleCount=0
- 16 tier-1 engines reported clean
- No sandbox malicious verdict or network indicators
- Medium prevalence with no external intelligence hits
- Unsigned ELF binary
- Single tier-1 malicious label with no family consensus
- Research-tool filename pattern may attract heuristic flags
Treat as borderline; obtain the file from a trusted official source or scan with additional local tools before use.
1 detection across 75 engines
How often this file shows up in the wild
Moderate prevalence — neither rare nor common. No strong prior applies.
Forensic fingerprint
- File name
- cheatengine-x86_64
- Size
- 22.18 MB
- MIME type
- (unknown)
- Detected type
- ELF
- SHA-256
- 180998238ef3239d9b954b67b3aca8bec17c341dce9c4814aa62f019e6992949
- MD5
- eb70c3d17a584a7fc8aad31cf645f4bc
- SHA-1
- 02402eaaefd92bc3028272193689e10246ec506c
- First seen (VT)
- 6/28/2026, 2:53:18 AM
- Last analysis (VT)
- 6/29/2026, 2:58:23 AM
- First scan (MalwareTips)
- 7/11/2026, 1:46:00 PM
- Last scan (MalwareTips)
- 7/11/2026, 1:46:00 PM
Safety FAQ
Common questions about cheatengine-x86_64, answered from the scan data above.
- cheatengine-x86_64 is suspicious — treat it as unsafe until you're sure. 1 of 75 antivirus engines flag it, which isn't a strong consensus but is enough to be cautious. Don't opened it unless you fully trust where it came from, and prefer downloading the software fresh from its official site.
- cheatengine-x86_64 is a file, about 22.2 MB. We identify a file by its cryptographic hash rather than its name, because the same filename can be reused by completely different files — the hash below is the reliable fingerprint.
- 1 of 75 antivirus engines flagged cheatengine-x86_64, 1 of them as outright malicious. A small number of detections can include false positives, so we weigh which engines flagged it and what else the file does, not just the raw count.
- Act quickly. 1) Disconnect the device from the internet to stop the malware communicating or spreading. 2) Run a full scan with reputable anti-malware software (such as Malwarebytes) and quarantine everything it finds. 3) Change your important passwords from a DIFFERENT, clean device — many threats log keystrokes or steal saved credentials. 4) If you bank or shop on this device, watch closely for fraud and alert your bank. 5) For a confirmed infection, the most reliable fix is to back up your personal files and reinstall the operating system for a clean start.
- To remove cheatengine-x86_64: 1) restart into Safe Mode (Safe Mode with Networking if you need to download a tool) so the malware doesn't auto-start. 2) Run a full scan with reputable anti-malware software and let it quarantine or delete the detections. 3) Delete the original cheatengine-x86_64 file and empty the Recycle Bin/Trash. 4) Check your browser extensions, startup items, and scheduled tasks for anything unfamiliar. 5) Reboot and scan again to confirm it's gone. If detections keep coming back, a clean operating-system reinstall is the most dependable cure.
- The SHA-256 hash of cheatengine-x86_64 is 180998238ef3239d9b954b67b3aca8bec17c341dce9c4814aa62f019e6992949, and its MD5 is eb70c3d17a584a7fc8aad31cf645f4bc. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.
- This report reflects the scan run on July 11, 2026. Because a file's hash never changes, the identity of cheatengine-x86_64 is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.