user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Trojan:Script/Wacatac.C!ml
Trojan:Script/Wacatac.C!ml - Windows Defender threat signature analysis

Trojan:Script/Wacatac.C!ml - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Trojan:Script/Wacatac.C!ml
Classification:
Type:Trojan
Platform:Script
Family:Wacatac
Detection Type:Concrete
Known malware family with identified signatures
Variant:C
Specific signature variant within the malware family
Suffix:!ml
Identified through machine learning models
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Trojan - Appears legitimate but performs malicious actions for Script platform, family Wacatac

Summary:

Trojan:Script/Wacatac.C!ml is a script-based trojan identified by a machine learning model. This malware is known for its ability to steal sensitive information, such as login credentials and system details. It frequently acts as a dropper to download and execute other malicious payloads, including ransomware or backdoors.

Severity:
High
VDM Static Detection:
No specific strings found for this threat
Known malware which is associated with this threat:
Filename: Encrypted_Script.ps1
234863f4d5d710de61e803b48792e1f5492bf89f5ba56b22c34a387884246482
09/12/2025
→VirusTotal↓Download Sample
Filename: Payment voucher.vbe
7e03c7a95cc8cb0b42fc689cebc0de8d47590bed519543a99457de40f66b455b
09/12/2025
→VirusTotal↓Download Sample
Filename: zp.vbs
829312bcc78702bdf915025c0ab78277c7c136adddf56f2157e617b0b51a2f3d
09/12/2025
→VirusTotal↓Download Sample
51f10cec857f7c25bc165cf8f882ce8d8f8852e17e086cb6e3e03eb9109ebe12
08/12/2025
→VirusTotal↓Download Sample
Filename: xnxnxnxnxnxnxnxnm68kxnxn
8f6ce0ae66f7f696d896f6b19234582bbd7969d34218f428e29b4ec186c46132
08/12/2025
→VirusTotal↓Download Sample
Remediation Steps:
Ensure the detected script has been quarantined or deleted by Windows Defender. Run a full system scan to identify any additional threats. Change passwords for all key accounts, especially those used on this machine, as this trojan is known to steal credentials.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 05/11/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊