[SECURITY] Windows Defender reports ` Trojan:Script/Wacatac.C!ml` on `7z2602-x64.msi`

[alicavus]

Maybe it is a false positive, but I can not download 7z2602-x64.msi, because Windows Defender reports it as Trojan:Script/Wacatac.C!ml

[alicavus]

#131 (also #132) is back once again...

[SeriousHoax]

MD detects the console version as well: Trojan:Win32/Wacatac.H!ml

[thezoggy]

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Script/Wacatac.C!ml

Trojan:Script/Wacatac.C!ml is classified as a broad heuristic label. It captures a range of malicious activities from modular malware families that employ advanced scripting and evasion techniques. This detection is not a single virus, but a behavioral signature often triggered by unauthorized registry changes, in-memory code execution, and the misuse of trusted system processes. These infections typically spread through social engineering, such as pirated software or phishing campaigns. Once inside a device, they focus on establishing persistence, deactivating Microsoft Defender, and creating covert communication channels. The heuristic nature of this detection can sometimes lead to false positives, where legitimate software is flagged.

submit to your malware provider for investigation to correct their heuristics and build rep for the new file

submitted github.com/ip7z/7zip/releases/download/26.02/7z2602-x64.msi for scanning, all good:
https://www.virustotal.com/gui/url/63f4002dd634635227e0f70a05701bd16e43db5a59550bcb676eeaa8ddac9de1
https://hybrid-analysis.com/sample/db407a4f6d4999e5c7bc00ce8a882be94717b56e7fa68140fe3f12605d91643e

[alicavus]

Latest Windows Defender updates mark 7z2602-x64.msi as safe.