DionysusFlow.scr Trojan Wacatac Analysis

Trojan Wacatac

Updated on 2024-09-30 (6 hours ago)

Online Virus Checker	v.1.0.191.174
DB Version:	2024-09-30 16:00:35

Ransom.Win32.Wacatac.oa!s1

Wacatac is a type of malware that falls under the wide category of computer viruses. It is known for its malicious capabilities, which include data theft, system compromise, and the execution of additional malicious payloads on the infected system like ransomware.

File	DionysusFlow.scr
Checked	2024-09-30 13:40:41
MD5	18ce19b57f43ce0a5af149c96aecc685
SHA1	1bd5ca29fc35fc8ac346f23b155337c5b28bbc36
SHA256	d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd
SHA512	a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558
Imphash	23c7b0116c8fb2e9410539ab80cfebbe
File Size	893608 bytes

Ransom.Win32.Wacatac.oa!s1 Removal

Gridinsoft has the capability to identify and eliminate Ransom.Win32.Wacatac.oa!s1 without requiring further user intervention.

Start by downloading Gridinsoft Anti-Malware to your computer.
Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
Click on the "Standard Scan" button.
After the scanning process is finished, click on "Clean Now" to remove any detected threats.
If prompted, restart your system to complete the removal process.

File Version Information

CompanyName	AutoIt Team
Comments	http://www.autoitscript.com/autoit3/
FileDescription	AutoIt v3 Script
FileVersion	3, 3, 14, 3
InternalName	AutoIt3.exe
LegalCopyright	©1999-2018 Jonathan Bennett & AutoIt Team
OriginalFilename	AutoIt3.exe
ProductName	AutoIt v3 Script
ProductVersion	3, 3, 14, 3
Translation	0x0809 0x04b0

Portable Executable Info

	5f8702d86df98c9381ccc31f02f1a13b cf183b497246574543bdbbe430437b0e e88e336969338ee8
Image Base:	0x00400000
Entry Point:	0x00427ffa
Compilation:	2018-01-30 12:07:13
Checksum:	0x000dcd15 (Actual: 0x000dcd15)
OS Version:	5.1
PEiD:	PE32 executable (GUI) Intel 80386, for MS Windows
Sign:	OK
Sections:	5
Imports:	WSOCK32, VERSION, WINMM, COMCTL32, MPR, WININET, PSAPI, IPHLPAPI, USERENV, UxTheme, KERNEL32, USER32, GDI32, COMDLG32, ADVAPI32, SHELL32, ole32, OLEAUT32,
Exports:	0
Resources:	28

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Entropy
.text	0x00001000	0x0008e7b1	0x0008e800	d3768a11ea36069481555571eb0e87cc	6.67
.rdata	0x00090000	0x0002fd8e	0x0002fe00	f0e823bd9244d52db867278fb1c8a7f3	5.76
.data	0x000c0000	0x00008f74	0x00005200	dcfc007fd1d97a1a6dc1794856b6d56b	1.19
.rsrc	0x000c9000	0x0000d750	0x0000d800	c3c33abe03ecc3b908b418cbe99f45f6	5.93
.reloc	0x000d7000	0x000071ac	0x00007200	0eb983e28371cb5c32033bbd12e446d6	6.80