Malicious
Two tier-1 engines identify Wacatac infostealer; sandbox telemetry confirms anti-analysis behaviour (bcdedit testsigning bypass).
1eea7acbe25fa162f1…4ceace75afThe verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
This file exhibits a clear malicious profile: two tier-1 antivirus engines (Microsoft Defender, Symantec) independently flagged it, with Microsoft naming Wacatac, a known infostealer family. The file is unsigned and rare (0 days old, 1 submitter), offering no signer legitimacy to contest the detections. Critically, sandbox telemetry shows the executable spawned a process chain executing 'bcdedit /set testsigning on', a well-known anti-analysis and anti-tamper technique used by malware to disable driver signature enforcement and evade security tools. This behaviour aligns with MITRE techniques T1490 (Inhibit System Recovery) and T1562.001 (Disable or Modify Tools), both offensive techniques used exclusively by malware and hacktools. While 69 of 71 engines remain silent and external intelligence (CIRCL, MalwareBazaar, YARA) returned no hits, the tier-1 consensus combined with confirmed offensive runtime behaviour overrides the low detection ratio. The absence of external corroboration likely reflects the sample's newness rather than legitimacy.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
Microsoft Defender (tier-1) flags 'Trojan:Win32/Wacatac.B!ml' — Wacatac is a known infostealer family
Symantec (tier-1) flags 'ML.Attribute.HighConfidence' — second tier-1 engine agreement on malicious classification
behaviour.offensiveTechniques=[T1490, T1562.001]; process telemetry shows 'bcdedit /set testsigning on' — anti-analysis / driver-signature-bypass technique
file: unsigned, rare_new (1 submitter, 0 days), no signer history to validate legitimacy
69/71 engines undetected; low external intel corroboration (no CIRCL, MalwareBazaar, YARA hits) — but tier-1 consensus + offensive MITRE techniques override low coverage
- No malicious network contact recorded in sandbox (no C2 beacons, no exfiltration domains)
- No dropped children or persistence mechanisms detected
- PE structure is clean (no packer, normal entropy, no high-entropy code sections)
- Tier-1 engine consensus: Microsoft Defender + Symantec both flag as malicious
- Named malware family: Wacatac infostealer (credential theft, information exfiltration)
- Anti-analysis behaviour: bcdedit testsigning bypass (T1490, T1562.001)
- Unsigned executable with no signer history
- Rare, newly submitted sample (0 days old, 1 submitter) — limited detection history
Isolate and remove this file immediately. Do not execute it under any circumstances. If already executed, perform a full system scan and reset credentials for sensitive accounts.
Wacatac corroborated by 1 source
- MT AI EngineWacatac
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- \Device\ConDrv\\Connect
2 detections across 75 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Barely seen in the wild and first surfaced recently. This is the footprint of targeted malware the AV industry hasn't signatured yet — extra scrutiny is warranted.
Forensic fingerprint
- File name
- JOAT(DEMOBUILD).exe
- Size
- 2.83 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- 1eea7acbe25fa162f1dd4a1fef0575d53b1d273226280a54b917db4ceace75af
- MD5
- 14fbd49d28d6a639bc2141eb7a9f2d17
- SHA-1
- ad0cad4e7a9b352b3931395d2562227f419ef1f6
- PE imphash
- 8dec79d1bb840033377e01e20cddc105
- First seen (VT)
- 6/9/2026, 3:50:36 PM
- Last analysis (VT)
- 6/9/2026, 3:50:36 PM
- First scan (MalwareTips)
- 6/9/2026, 4:13:43 PM
- Last scan (MalwareTips)
- 6/9/2026, 4:13:43 PM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.