Suspicious
Unsigned AutoClicker.exe exhibits process injection (T1055), direct IP contacts, and evasion tags but lacks tier-1 engine consensus amid low detections and high prevalence.
1ce7da6f2813c2ad1d…894c9a6ec1The reasoning behind this verdict
The MT AI Engine weighs every signal from this scan — antivirus detections, sandbox behaviour, code signing, prevalence and historical matches — to reach a single, evidence-based verdict.
Few engines flag this file, with no tier-1 detections and 17 tier-1 clean reports, suggesting potential overreach by lower-trust scanners. However, behavioural analysis reveals offensive MITRE techniques including process injection and token manipulation, corroborated by high-severity heuristics. Direct IP contacts bypassing DNS and suspicious process spawns like randomized Google updaters align with malware evasion. Despite common prevalence, the negative reputation and anti-analysis tags tip toward caution. Community notes are split, lacking ground truth.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
Gridinsoft (tier2): Malware.Win64.XWorm.tr
triggeredHeuristics[0].rule 'MalwareTips.Synth.ProcessInjection' fired (T1055)
behaviour.contactedIps length=15 (e.g., '20.99.133.109'), contactedDomains=[]
file.tags: 'detect-debug-environment', 'long-sleeps'
file.reputation: -10
- engines.tier1Malicious=0, 17 tier1 clean
- prevalence.common_old (60742 submissions)
- No malicious dropped children or sandbox verdicts
- No malicious contacted hosts
- Process injection (T1055) heuristic fired
- Direct IP C2 pattern (15 IPs, 0 domains)
- Evasion tags: detect-debug-environment, long-sleeps
- Suspicious fake Google updater processes
- Negative reputation (-10) despite high prevalence
- Gridinsoft tier2 'Malware.Win64.XWorm.tr' detection
Treat as suspicious: do not run, quarantine immediately, and upload to additional sandboxes for confirmation. If needed for automation, seek signed alternatives from trusted sources.
What this file does
What it attempted when executed in an isolated sandbox
High concern: Hides inside another running program to evade antivirus.
High concern: Records what you type — keylogger behaviour.
High concern: Talks to a remote server to take commands or send out your data.
High concern: Downloads more malware onto your PC.
High concern: Sets itself to run automatically every time you start your PC.
Moderate concern: Obfuscates or packs its code to avoid detection.
Moderate concern: Lists running programs — often to find security tools.
Translated from the file's technical behaviour during analysis. It never ran on your device.
What to do now
We couldn't fully clear this file. Treat it with caution.
Don't run it unless you're certain it came from a source you trust.
Check where you got it — an email attachment or a random download link is a red flag.
If you're unsure, delete it. You can always re-download a clean copy from the official source.
If you're still unsure, scan it again in a day or two — detections often catch up on newer files.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 20.99.133.109
- 192.229.211.108
- a83f:8110:0:0:1b00:100:2800:0
- 192.168.0.43
- 23.216.81.152
- 131.253.33.203
- 192.168.0.67
- 23.55.140.42
- 20.99.186.246
- 23.198.171.50
- C:\Users\<USER>\AppData\Local\Temp\vthtdci
- C:\Users\<USER>\Desktop\ACLib\playback.ico
- C:\Users\<USER>\Desktop\ACLib\record.ico
- C:\Users\<USER>\Desktop\ACLib\stop.ico
- C:\Users\<USER>\AppData\Local\Temp\dkecqvb
- C:\Users\<USER>\AppData\Local\Temp\vthtdci
- %USERPROFILE%\AppData\Local\Temp\creqhzj
- C:\Windows\System32\spp\store\2.0\cache\cache.dat
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER314C.tmp.WERInternalMetadata.xml
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER3330.tmp.csv
Files this sample writes at runtime
This file drops 4 children at runtime. None are currently flagged malicious in our cache.
- 6f84c8650acc3464c42d…0f8764Never scannednever seen before
- 5375290e66a20bff81fb…3fe80dNever scannednever seen before
- 9e869f60ea0a0de06c7d…649483Never scannednever seen before
- 59d5e9106e907fa61a56…7287a6Never scannednever seen before
YARA & heuristic rule matches
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
Evidence"C:\Users\<USER>\Desktop\file.exe"Sample contacted 15 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence20.99.133.109 · 192.229.211.108 · a83f:8110:0:0:1b00:100:2800:0
2 detections across 75 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Forensic fingerprint
- File name
- AutoClicker.exe
- Size
- 1.13 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- 1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1
- MD5
- 913a423f66aa1c41e374e21a911a3c20
- SHA-1
- 449df612d0f02e868992faabfbf4d5d37c727936
- PE imphash
- 161c85364c462057ba28801ac1ad5404
- First seen (VT)
- 3/30/2024, 1:17:12 PM
- Last analysis (VT)
- 5/1/2026, 11:47:18 AM
- First scan (MalwareTips)
- 5/1/2026, 1:21:36 PM
- Last scan (MalwareTips)
- 5/1/2026, 2:11:19 PM
- Community reputation
- -10flagged
Safety FAQ
Common questions about AutoClicker.exe, answered from the scan data above.
- AutoClicker.exe is suspicious — treat it as unsafe until you're sure. 2 of 75 antivirus engines flag it, which isn't a strong consensus but is enough to be cautious. Don't run it unless you fully trust where it came from, and prefer downloading the software fresh from its official site.
- AutoClicker.exe is a Windows executable program, about 1.1 MB. We identify a file by its cryptographic hash rather than its name, because the same filename can be reused by completely different files — the hash below is the reliable fingerprint.
- 2 of 75 antivirus engines flagged AutoClicker.exe, 2 of them as outright malicious. A small number of detections can include false positives, so we weigh which engines flagged it and what else the file does, not just the raw count.
- Act quickly. 1) Disconnect the device from the internet to stop the malware communicating or spreading. 2) Run a full scan with reputable anti-malware software (such as Malwarebytes) and quarantine everything it finds. 3) Change your important passwords from a DIFFERENT, clean device — many threats log keystrokes or steal saved credentials. 4) If you bank or shop on this device, watch closely for fraud and alert your bank. 5) For a confirmed infection, the most reliable fix is to back up your personal files and reinstall the operating system for a clean start.
- To remove AutoClicker.exe: 1) restart into Safe Mode (Safe Mode with Networking if you need to download a tool) so the malware doesn't auto-start. 2) Run a full scan with reputable anti-malware software and let it quarantine or delete the detections. 3) Delete the original AutoClicker.exe file and empty the Recycle Bin/Trash. 4) Check your browser extensions, startup items, and scheduled tasks for anything unfamiliar. 5) Reboot and scan again to confirm it's gone. If detections keep coming back, a clean operating-system reinstall is the most dependable cure.
- The SHA-256 hash of AutoClicker.exe is 1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1, and its MD5 is 913a423f66aa1c41e374e21a911a3c20. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.
- This report reflects the scan run on May 1, 2026. Because a file's hash never changes, the identity of AutoClicker.exe is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.