Trojan:Win32/Wacatac.H!ml threat

[lekthailtd-bit]

📸 Screenshot / Screen Recording (Highly Recommended)

Attach a screenshot or short video showing the issue.

---

🐞 Describe the Bug

A clear and concise description of the problem you are experiencing.

Windows defender blocks the execution of the latest release due to being infected with Trojan:Win32/Wacatac.H!ml

The supporting page is https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AWin32%2FWacatac.H!ml&threatid=2147814523

🔁 Steps to Reproduce

Please describe exactly how to reproduce the issue:

1. Download from https://github.com/Shrey113/Adb-Device-Manager-2/releases/download/ADB-Device-Manager-v.1.6.1/adb_devices.exe (SHA-256
   1727d1d4b718da8657bc60b04a52c3833881b5b226bdc6ffd3ac8a71955fdc18
2. Before execution, windows Defender scans after download has completed and deletes the file.

---

✔️ Expected Behavior

What you expected to happen instead.

To download and install the application

---

💻 Windows System Information

Please complete the following details:

• Windows Version: (Windows 11 25H2 26200.8246)

• App Version (.exe): (e.g., v1.1-prebuild) Latest, v1.6.1

• SHA-256 1727d1d4b718da8657bc60b04a52c3833881b5b226bdc6ffd3ac8a71955fdc18

• [VirusTotal Scan.]
  https://www.virustotal.com/gui/file/1727d1d4b718da8657bc60b04a52c3833881b5b226bdc6ffd3ac8a71955fdc18)

• Firewall or Antivirus Enabled? (Yes) Windows Defender

[Shrey113]

Thanks for reporting this issue

This detectin (Trojan:Win32/Wacatac.H!ml) is most likely a false positive and usually happens due to how the app is built rather than actual malicious code.

Some possible reasons:

• The app uses ADB/system commands, which can look suspicios to antivirus
• The executable is not code signed (so Windows treats it as low trust)
• The binary is packaged/bundled, which sometimes triggers heuristik detection
• The file is new and do’t have enough reputation yet

So nothing harmful is intentionally includ, but I understand the concern.

I’ll reviev the build process and work on improving this (like rebuilding or signing the app) to avoid this detection in future releases.

Thanks again for pointing this out 👍