File verdict·Decided by the MT AI Engine
Our call

Suspicious

Single tier-1 detection on an unsigned research-tool ELF with no corroboration or runtime indicators.

Trust score55Caution
cheatengine-x86_64
22.2 MB
180998238ef3239d9b19e6992949
Antivirus engines
1 of 75 flagged
Code signing
Unsigned
Age
First seen 14 days ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

65%Confidence
High
Reasoning

The detection profile shows a classic single-engine outlier on an ELF binary whose filename explicitly signals a reverse-engineering tool. No tier-1 family consensus exists, behaviour data is absent, and external intelligence sources returned zero hits. Unsigned status and lack of RAG matches leave the file in mixed-signals territory rather than a clear malicious or safe classification.

Key signals · 4

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. engines.topDetections[0]: Microsoft tier1 'Trojan:Script/Wacatac.B!ml' (single tier1 flag, no family consensus)

  2. filenameAnalysis.looksLikeResearchTool=true and triggeredHeuristics[0].rule=filename_research_tool

  3. prevalence.classification=medium (13 uniqueSources, 23 submissions) and file.ageDays=13

  4. signing.signed=false and externalIntel.yaraify.ruleCount=0

Points in its favour
  • 16 tier-1 engines reported clean
  • No sandbox malicious verdict or network indicators
  • Medium prevalence with no external intelligence hits
Points against
  • Unsigned ELF binary
  • Single tier-1 malicious label with no family consensus
  • Research-tool filename pattern may attract heuristic flags
What to do

Treat as borderline; obtain the file from a trusted official source or scan with additional local tools before use.

No researcher-database hits
External threat-intel sources were not collected for this scan.
Antivirus engine breakdown

1 detection across 75 engines

1 malicious0 suspicious74 clean
Tier-117 engines
1flag
Top commercial AVs (low FP rate)
Tier-241 engines
0flag
Mainstream engines with mixed FP rates
Low-trust17 engines
0flag
Heuristic / generic-AI engines (high FP rate)
Microsoft
malicious
Trojan:Script/Wacatac.B!ml
Hash 180998238ef3… cross-referenced against 75 AV engines via our AV network.
Prevalence

How often this file shows up in the wild

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium
Unique uploaders
13
Moderate upload volume.
Total submissions
23
Includes repeat uploads by the same source.
First seen by VT
13d ago
Jun 28, 2026
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
6/28/2026, 2:53:18 AM
First seen (MalwareBazaar)
Last analysis (VT)
6/29/2026, 2:58:23 AM
Scanned here
7/11/2026, 1:46:00 PM
File name
cheatengine-x86_64
Size
22.18 MB
MIME type
(unknown)
Detected type
ELF
SHA-256
180998238ef3239d9b954b67b3aca8bec17c341dce9c4814aa62f019e6992949
MD5
eb70c3d17a584a7fc8aad31cf645f4bc
SHA-1
02402eaaefd92bc3028272193689e10246ec506c
First seen (VT)
6/28/2026, 2:53:18 AM
Last analysis (VT)
6/29/2026, 2:58:23 AM
First scan (MalwareTips)
7/11/2026, 1:46:00 PM
Last scan (MalwareTips)
7/11/2026, 1:46:00 PM
Behavior tags
64bitself
Frequently asked

Safety FAQ

Common questions about cheatengine-x86_64, answered from the scan data above.

  • cheatengine-x86_64 is suspicious — treat it as unsafe until you're sure. 1 of 75 antivirus engines flag it, which isn't a strong consensus but is enough to be cautious. Don't opened it unless you fully trust where it came from, and prefer downloading the software fresh from its official site.
  • cheatengine-x86_64 is a file, about 22.2 MB. We identify a file by its cryptographic hash rather than its name, because the same filename can be reused by completely different files — the hash below is the reliable fingerprint.
  • 1 of 75 antivirus engines flagged cheatengine-x86_64, 1 of them as outright malicious. A small number of detections can include false positives, so we weigh which engines flagged it and what else the file does, not just the raw count.
  • Act quickly. 1) Disconnect the device from the internet to stop the malware communicating or spreading. 2) Run a full scan with reputable anti-malware software (such as Malwarebytes) and quarantine everything it finds. 3) Change your important passwords from a DIFFERENT, clean device — many threats log keystrokes or steal saved credentials. 4) If you bank or shop on this device, watch closely for fraud and alert your bank. 5) For a confirmed infection, the most reliable fix is to back up your personal files and reinstall the operating system for a clean start.
  • To remove cheatengine-x86_64: 1) restart into Safe Mode (Safe Mode with Networking if you need to download a tool) so the malware doesn't auto-start. 2) Run a full scan with reputable anti-malware software and let it quarantine or delete the detections. 3) Delete the original cheatengine-x86_64 file and empty the Recycle Bin/Trash. 4) Check your browser extensions, startup items, and scheduled tasks for anything unfamiliar. 5) Reboot and scan again to confirm it's gone. If detections keep coming back, a clean operating-system reinstall is the most dependable cure.
  • The SHA-256 hash of cheatengine-x86_64 is 180998238ef3239d9b954b67b3aca8bec17c341dce9c4814aa62f019e6992949, and its MD5 is eb70c3d17a584a7fc8aad31cf645f4bc. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.
  • This report reflects the scan run on July 11, 2026. Because a file's hash never changes, the identity of cheatengine-x86_64 is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.