GDWeave has Wacatac trojan - Not a false positive

[RabbitStewGames]

Recently Windows Defender has been flagging a potential trojan in winmm.dll, but it's not actually a false positive. A friend of mine had their Steam profile compromised.

The trojan in question is a Wacatac trojan, or a trojan that stealthily performs malicious actions (in this case, sending phishing links to Steam friends) without your knowledge.

Please investigate the latest Thunderstore release, as it may be compromised.

[NotNite]

No, it's not, and I don't appreciate these heavy claims. Your friend must've fallen for something else unrelated, and you incorrectly correlated the two. Closing.

Commit 32ee3e5 changed the hook that initializes GDWeave to happen in the PE entrypoint instead of DllMain. This avoids loader lock and allows us to create threads inside of GDWeave mods. This is done by calling GetModuleInformation and then using retour to initialize a hook on the EntryPoint pointer.

This sets off false positives in antiviruses - Defender specifies Trojan:Win32/Wacatac.B!ml. The !ml flag indicates this was through its machine learning model - not a known threat, but an assumed one. This matches with what you reported.

If you don't trust me, you can download the thunderstore.zip package from this GitHub Action run built with this workflow on this commit, along with the upload to Thunderstore, and compare the two files:

$ Get-FileHash .\winmm.dll

Algorithm       Hash                                                                   Path
---------       ----                                                                   ----
SHA256          CEB9EDCD52FDCD24ED0BF6C36AF365B9614B7F2BDABCF2916BA01FEF2B9306E8       C:\Users\Julian\Downloads\winmm.dll

$ Get-FileHash .\winmm_thunderstore.dll

Algorithm       Hash                                                                   Path
---------       ----                                                                   ----
SHA256          CEB9EDCD52FDCD24ED0BF6C36AF365B9614B7F2BDABCF2916BA01FEF2B9306E8       C:\Users\Julian\Downloads\winmm_thunderstore.dll