What is “BScope.Trojan.Wacatac”?

The BScope.Trojan.Wacatac is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What BScope.Trojan.Wacatac virus can do?

• Executable code extraction
• Attempts to connect to a dead IP:Port (1 unique times)
• Creates RWX memory
• A process attempted to delay the analysis task.
• Reads data out of its own binary image
• The binary likely contains encrypted or compressed data.
• Attempts to repeatedly call a single API many times in order to delay analysis time
• Installs itself for autorun at Windows startup
• Writes a potential ransom message to disk
• Creates a copy of itself
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

How to determine BScope.Trojan.Wacatac?

File Info:
crc32: 1DDCC4F8md5: dc2a5b9b07eb864629b82e912ac6737dname: starticon5.exesha1: 9227291ec8c99d8ef524359dfd1da2c026945b61sha256: f39c954c592021cf567b3bec1793399e80df0cfbf89816772f851c761c2387fbsha512: d1373f1ce94b26867cdf23f4e1540ae5dd97c75ece7f4bfe5626e00eca4936a0b9fafcf26b58b267f8201aff7a47bc8bb6064d67be8c9dbcce871fd902449210ssdeep: 12288:iN7qngfWyubuNNq9AQgLK1XiQVngIWvxFkacSpMsPRmbSm+j6RAvJcmaUtva:i9qYWyoA0yGngIWvxSajrRmbSoRiDRatype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Copyright (C) 2019, ghjhfkhInternalName: fyukfuyk.exeFileVersion: 1.0.5.4Translation: 0x0841 0x04c4

BScope.Trojan.Wacatac also known as:

MicroWorld-eScan	Trojan.GenericKD.32652689
CAT-QuickHeal	Ransom.STOP.S8831455
McAfee	RDN/Generic.grp
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Zbot.m6l9
K7AntiVirus	Trojan ( 0055a7311 )
Alibaba	Trojan:Win32/Injector.8763b290
K7GW	Trojan ( 0055a7311 )
Cybereason	malicious.ec8c99
Arcabit	Trojan.Generic.D1F23D91
TrendMicro	TROJ_FRS.VSNW1DJ19
F-Prot	W32/Kryptik.API.gen!Eldorado
Symantec	Packed.Generic.525
ESET-NOD32	a variant of Win32/Injector.EION
Paloalto	generic.ml
ClamAV	Win.Malware.Generic-7366725-0
Kaspersky	HEUR:Trojan.Win32.Chapak.pef
BitDefender	Trojan.GenericKD.32652689
NANO-Antivirus	Trojan.Win32.Dwn.gffugx
Rising	Trojan.Generic@ML.97 (RDMK:JcMuME0NbqVQHDb6HXxr4w)
Endgame	malicious (high confidence)
Emsisoft	Trojan.GenericKD.32652689 (B)
F-Secure	Trojan.TR/AD.InstaBot.bxbli
DrWeb	Trojan.DownLoader30.31303
Zillya	Trojan.Injector.Win32.663188
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Generic.bc
Fortinet	W32/Injector.EION!tr
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.dc2a5b9b07eb8646
Sophos	Mal/GandCrab-G
SentinelOne	DFI – Malicious PE
Cyren	W32/Trojan.UDHO-2675
Webroot	W32.Malware.Gen
Avira	TR/AD.InstaBot.bxbli
MAX	malware (ai score=81)
Antiy-AVL	Trojan/Win32.GandCrab
Microsoft	Trojan:Win32/Predator.PA!MTB
ZoneAlarm	HEUR:Trojan.Win32.Chapak.pef
AhnLab-V3	Trojan/Win32.RL_MalPe.R296523
Acronis	suspicious
VBA32	BScope.Trojan.Wacatac
ALYac	Trojan.Ransom.Stop
Ad-Aware	Trojan.GenericKD.32652689
Malwarebytes	Trojan.MalPack.GS
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_FRS.VSNW1DJ19
Yandex	Trojan.Injector!rX0vKFAxuuk
Ikarus	Trojan.Inject
GData	Trojan.GenericKD.32652689
BitDefenderTheta	Gen:NN.ZexaF.32248.SG0@a8XRp5o
AVG	Win32:CrypterX-gen [Trj]
Avast	Win32:CrypterX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Trojan.Generic

How to remove BScope.Trojan.Wacatac?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.