Trojan:Win32/Wacatac.H!ml in rd-usb-v1.24.2.exe

[AlexKay88]

Hi,
current rd-usb-v1.24.2.exe is infected with malware!
Yesterday I downloaded
https://github.com/kolinger/rd-usb/releases/download/1.24.2/rd-usb-v1.24.2.exe
and Microsoft Defender Advanced Threat Protection blocked access to download file, because its infected with
Trojan:Win32/Wacatac.H!ml
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AWin32%2FWacatac.H!ml&threatid=2147814523
I also observed file size growing from 17MB to 19MB during last 2 releases.

[kolinger]

If the SHA-1 hash of rd-usb-v1.24.2.exe is 536033CF1E04A7AB307DF5F8D141294F861191AD then it's the right file.
There are some detections on this file, but it's miss rather than hit.

The size delta looks normal if you consider how the .exe is generated. The pyinstaller build isn't deterministic in sense it always rescans dependencies and libraries and what is included or not depends on this dynamic analysis, thus some variance is expected. The underlying libraries may be different, and this may include/exclude files and this can explain the variation. But as far as I know the "malware" was always my own code, rather than dependency.

I got trojan detection on compiled version of tc.py on my own system not that long ago, yet that's nonsense. You can read the source code yourself and also run the project directly via Python so you know you run the code you see.

There is history of different trojan detection and this prior instance was resolved by doing nothing, after some time it wasn't trojan anymore.

The problematic thing about this is that I have no direct way to fix it, since if regular python code written by myself is detected as malware, then what is the fix? To write different code that could be also "malware"-like?

I can only suggest either using older version that doesn't trigger the detection, or trying to run the rd-usb via Python directly, or just to wait, perhaps next month it won't be malware anymore, who knows.