- Jan 8, 2022
- 146
- 154
i would scan it when runningThread reverted. Gonna check now. I actually did check it but couldn't find anything.
Will do a recheck.
it collects fast , and deletes itself after usage ( what is in the bin file)
i would scan it when runningThread reverted. Gonna check now. I actually did check it but couldn't find anything.
Will do a recheck.
Hmm. I used a Sandbox to test and check, got no warnings etc. It also list every try to connect to the internet, etc. Gonna inform Sam.i would scan it when running
it collects fast , and deletes itself after usage ( what is in the bin file)
Download the script if 10 minutes have passed since the first run
I see, I actually Unzipped the game but didn't run it, so I tried to run it now and it created a bin folder with timestamp.txt file. Closed it right away, did a scan and didn't find anything with but yeah something is weird in all this. Guess I'll just delete the unzipped folder right away and wait for something more safe.bin folder is so the trojan can make a own path to get access to your files etc
# Download the script if 10 minutes have passed since the first run
thats what im going to do from now onAfter this stuff started happening I just use sandboxie to play all the game I download from here. You can make it so anything running inside the sandbox can't connect to the internet so even if you download an infected game, you should be fine because it can not download the malware.
If i don't have the bin folder it means I'm safe? Or the virus deleted the folder too?bin folder is so the trojan can make a own path to get access to your files etc
bin folder staysIf i don't have the bin folder it means I'm safe? Or the virus deleted the folder too?
Doesn't hurt to do a full scan of your pc just to be safe.If i don't have the bin folder it means I'm safe? Or the virus deleted the folder too?
So I guess it never downloaded the virus for some reason?bin folder stays
but they rolled back to build4 what i have seen so no longer the latest
Did you had the game run more than 10 minutes? Or your Antivir/Win Defender blocked it.So I guess it never downloaded the virus for some reason?
with me it actually responded in less than 1 minute, so woudn't count on the 10 minute rule imoDid you had the game run more than 10 minutes? Or your Antivir/Win Defender blocked it.
Its in the script though.with me it actually responded in less than 1 minute, so woudn't count on the 10 minute rule imo
casn it be counting up, so lets say multiple runs of 1 or 2 minutes that triggers it ? (after 10 minutes in total ? )Its in the script though.
Actually it creates a timestamp file. (thats prob what your antivir detected)
Then if the the timestamp file exist after another 10 minutes it downloads stuff.
10 minutes twice:casn it be counting up, so lets say multiple runs of 1 or 2 minutes that triggers it ? (after 10 minutes in total ? )
if datetime.now() - first_run < timedelta(minutes=10):
Which file has this script?10 minutes twice:
if datetime.now() - first_run < timedelta(minutes=10):
it was the leaked latest update for r3, you can safely download the old r3 versionWhich file has this script?
Maybe only R3 is affected? I played R1-R2
Yes only R3 was affected.Which file has this script?
Maybe only R3 is affected? I played R1-R2
The links are now fine I cleaned it up and reuploaded PC (that was the only version affected).it was the leaked latest update for r3, you can safely download the old r3 version
It can hide from VM"s and the like.Hmm. I used a Sandbox to test and check, got no warnings etc. It also list every try to connect to the internet, etc. Gonna inform Sam.
WELL MOTHER FUCKER
Trojan:Win32/Wacatac.H!ml can evade detection by performing checks to ensure it is not being executed in a debug environment, on a virtual machine, or in a banned country. While being present in nearly any malware, country checks are most commonly seen in malware that originates from ex-USSR countries.
Additionally, it establishes persistence in the attacked environment by creating a randomly named copy in a random directory in the AppData or LocalAppData folder of a user directory and adding a corresponding value to the Run entry of the system registry. By doing this, malware makes itself harder to stop and remove, ensuring that its execution will not be interrupted by restarts or file deletion.
Machine Learning or Artificial Intelligence detection.
Machine Learning is a system at your antivirus developer that tries to identify features common to malware. It could be any kind of malware, could be a potentially unwanted program(ie. adware), could be a false positive.