Categories: Trojan

What is “Trojan.Wacatac.S19452450”?

The Trojan.Wacatac.S19452450 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Wacatac.S19452450 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Dynamic (imported) function loading detected
Yara rule detections observed from a process memory dump/dropped files/CAPE
Possible date expiration check, exits too soon after checking local time
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Executable file is packed/obfuscated with MPRESS
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Deletes executed files from disk

How to determine Trojan.Wacatac.S19452450?


File Info:
name: E04B3E41D0E08207E185.mlwpath: /opt/CAPEv2/storage/binaries/6a540afe680207bb341b50ed3f52483d74583090a05a44dd908c7150c6ba5e10crc32: 25D17B6Cmd5: e04b3e41d0e08207e185a6ac6a4a1538sha1: 7b15eefef286f1bc105fc1034c61fe83ed17a5acsha256: 6a540afe680207bb341b50ed3f52483d74583090a05a44dd908c7150c6ba5e10sha512: bfb1d41e2af1012e369d0a08bfaed216c9a4135cee9f3ba9c678dceef2146fbf296e47694e276297ae669b030830aba73560f671fb854292ce1400c7fa7b1a23ssdeep: 6144:Slvaiq8W9pNdKJcYC0JIpDqHeGdHWqA+V2:hgKTScYbep2HXr8type: PE32 executable (console) Intel 80386, for MS Windowstlsh: T1CE242206AA6E42D4FF4D30771AB9F44338F2F62D186DD742E30B80A52CDEB2245BD45Asha3_384: d0aea25d71cea9e44071aafc7062eb38d969bb0f51349648fac38b8c6f60bca293d28e5f1f3e22345a1116104b8b1a05ep_bytes: 60e80000000058055a0b00008b3003f0timestamp: 2011-03-25 13:17:51
Version Info:
0: [No Data]

Trojan.Wacatac.S19452450 also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.BAT.Agent.4!c
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Wacatac.S19452450
McAfee	GenericRXNM-EU!E04B3E41D0E0
Cylance	Unsafe
VIPRE	Dropped:Trojan.Bat.AAPW
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005768dd1 )
BitDefender	Dropped:Trojan.Bat.AAPW
K7GW	Trojan ( 00577de81 )
Cybereason	malicious.1d0e08
Cyren	W32/Dropper.EG.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of BAT/Agent.NAS
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Tool.Kmsauto-9848584-0
Kaspersky	Trojan.BAT.Agent.bbn
Alibaba	TrojanDropper:BAT/BcryptInject.e4f2056c
MicroWorld-eScan	Dropped:Trojan.Bat.AAPW
Avast	Win32:Malware-gen
Rising	Trojan.Agent!8.B1E (CLOUD)
Ad-Aware	Dropped:Trojan.Bat.AAPW
Emsisoft	Dropped:Trojan.Bat.AAPW (B)
DrWeb	Trojan.Siggen12.42972
TrendMicro	TROJ_GEN.R002C0DCC21
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.e04b3e41d0e08207
Sophos	Mal/Generic-R + Bat/Agent-BGKR
Ikarus	Virus.BAT.Agent
GData	Dropped:Trojan.Bat.AAPW
Jiangmin	Trojan.BAT.adj
Avira	TR/Redcap.osjdd
Antiy-AVL	Trojan/Generic.ASMalwS.79E
Arcabit	Trojan.Bat.AAPW
ZoneAlarm	Trojan.BAT.Agent.bbn
Microsoft	TrojanDropper:Win32/BcryptInject.A!MTB
AhnLab-V3	Malware/Win32.RL_Generic.R356312
Acronis	suspicious
VBA32	Trojan.BAT.Agent
ALYac	Dropped:Trojan.Bat.AAPW
MAX	malware (ai score=82)
Malwarebytes	Malware.AI.2733376430
TrendMicro-HouseCall	TROJ_GEN.R002C0DCC21
Tencent	Bat.Trojan.Agent.Agul
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Agent.BBN!tr
BitDefenderTheta	Gen:NN.ZexaF.34806.Ry0@aSfE0Qb
AVG	Win32:Malware-gen
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_60% (W)