A Windows release of RAM, a desktop app built with Rust, Tauri 2 and React, began triggering Microsoft Defender’s Trojan:Win32/Wacatac.B!ml warning. Its author, Luan Silveira Macea, first inspected differences between the last clean and flagged executables, but that analysis pointed him in the wrong direction. Building and scanning intermediate commits with git bisect led to the commit that added sodiumoxide for account-file encryption.
That account does not establish that libsodium is malware or that it generally causes antivirus detections. It shows a more useful lesson for developers facing an unexplained flag: inspect binaries for clues, but test the project’s history to identify which change tracks with the result.
As an Amazon Associate I earn from qualifying purchases.
What was flagged, and what the result did—and did not—mean
RAM (Roblox Account Manager) is a Windows desktop app that Macea describes as managing multiple Roblox accounts, launching multiple game clients and automating tasks such as rejoining servers. After a release, he reports that VirusTotal showed one detection out of 75 engines, with Microsoft identifying the executable as Trojan:Win32/Wacatac.B!ml. The incident and figures here are Macea’s account, published September 30, 2026; they are not independent scans of the binaries.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →A single engine’s detection is a reason to investigate, not proof that an application is malicious or proof of why it was flagged. The !ml suffix and the proposed role of a heuristic or machine-learning judgment are Macea’s interpretation of the result; the detector’s internal reasoning is not established in the report. Nor does a later clean scan guarantee that another hash, engine version or user’s local installation will receive the same verdict.
#1 Best Overall
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Why the executable comparison did not identify the change
Macea compared the last executable he considered clean with the flagged one using pefile. He found the same 16 imports he considered heuristically heavy, matching section entropy and linker, plus four new imports he characterized as ordinary file or message operations. Those observations led him initially to suspect that the detection model had simply changed its mind.
That comparison did not isolate the project change associated with the result. Similar-looking import tables or other binary properties cannot by themselves establish which source revision correlates with a detection. The more direct diagnostic was to build versions from the project’s history and scan them.
How bisection narrowed the investigation
- Choose the known endpoints. Identify a revision whose release build was reported clean and one whose build was reported flagged. Keep the build configuration and packaging as consistent as possible so that changes in the result are easier to interpret.
- Build and scan an intermediate revision. Test a commit between the endpoints, recording the exact commit, artifact hash, scanner and verdict. The result tells you which half of the history to investigate next.
- Repeat until the interval is small. Use
git bisectto guide the search, marking tested revisions good or bad according to the scan result. This only works if each tested revision can be built and the labels reflect actual results rather than build or scan failures. - Inspect the first change associated with the flag. In Macea’s account, this process traced the first bad build to the commit that integrated account-file encryption using
sodiumoxide, Rust bindings to libsodium.
The finding is a correlation in this project’s tested history: the first flagged build tracked to the crypto-integration commit. Macea suggested that statically linked native cryptographic code, in an application that also handles credentials and automates processes, may have contributed to a heuristic classifier’s judgment. The report does not reveal the engine’s feature weights or prove that this was the detector’s reason.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Why the crypto change was not proof of malware
Cryptography is a normal application feature, and the incident does not show that libsodium or sodiumoxide is unsafe. It also does not establish that replacing a native library with pure Rust will generally prevent false positives. Macea explicitly says libsodium itself was not at fault; the broader lesson is to treat a newly correlated dependency or feature as an investigative lead, not as a verdict about the library.
A bisect can identify a change associated with a result, but it cannot alone prove the antivirus engine’s causal reasoning. Other changes in the same commit, build differences, changing signatures or scan timing can complicate interpretation. Preserve the exact artifacts and scanner results if you need to distinguish those possibilities.
Replacing the implementation without losing encrypted files
Because existing users already had encrypted account files, the replacement had to preserve their ability to decrypt data written by the previous implementation. Macea says he moved to pure-Rust crates named argon2, crypto_secretbox (XSalsa20-Poly1305) and sha2, selecting parameters to match the earlier implementation.
Rank #3
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
The article specifies Argon2i version 0x13, time cost 6, memory cost 128 MiB, parallelism 1 and a 32-byte output. It also says the replacement’s crypto_secretbox uses the same MAC-before-ciphertext layout as libsodium. These are implementation details reported for this project, not a general prescription for new cryptographic designs.
Test old data, not just a new round trip
A round-trip test that encrypts and decrypts with the replacement can pass even if its parameters or serialization differ from the old format. Macea describes a stronger compatibility check: a fixture containing bytes encrypted by the old implementation must decrypt under the new one to the expected plaintext. That test checks that existing persisted data remains readable.
When replacing a cryptographic implementation that owns stored user data, retain a known legacy ciphertext fixture and verify decryption against expected plaintext. Treat changes to key derivation parameters, nonce handling, authentication data and byte layout as compatibility-sensitive; a successful test using only newly written ciphertext does not cover old files.
Rank #4
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows (Windows 7 with Service Pack 1, Windows 8, Windows 8.1, Windows 10, and Windows 11), Mac OS (Yosemite 10.10 or later), iOS (11.2 or later), and Android (5.0 or later). Organize and keep your digital life safe from hackers
- SAFE ONLINE BANKING: A unique, dedicated browser secures your online transactions; Our Total Security product also includes 200MB per day of our new and improved Bitdefender VPN
- ADVANCED THREAT DEFENSE: Real-Time Data Protection, Multi-Layer Malware and Ransomware Protection, Social Network Protection, Game/Movie/Work Modes, Microphone Monitor, Webcam Protection, Anti-Tracker, Phishing, Fraud, and Spam Protection, File Shredder, Parental Controls, and more
- ECO-FRIENDLY PACKAGING: Your product-specific code is printed on a card and shipped inside a protective cardboard sleeve. Simply open packaging and scratch off security ink on the card to reveal your activation code. No more bulky box or hard-to-recycle discs. PLEASE NOTE: Product packaging may vary from the images shown, however the product is the same.
Performance costs Macea reported
Matching the old behavior had a development-build cost in Macea’s project. He reports that one Argon2 derivation took 5.4 seconds in a debug build and 0.3 seconds in an optimized build. He also reports the Rust test suite falling from 230 seconds to 41 seconds after configuring dependency optimization in the development profile while leaving the application crate unoptimized. These are project-specific measurements from his article, not reproduced benchmarks or predictions for other machines and workloads.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the reported scans showed
Macea reported the following before-and-after scan snapshots for the builds he tested. The counts are detections out of the number of engines included in each reported VirusTotal result; they should not be read as a guarantee for other hashes, later engine versions or local systems.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Artifact | Before | After | Other reported detail |
|---|---|---|---|
| App executable | 1/75, including Microsoft Wacatac.B!ml |
0/75 | Macea also reported Defender clean after the replacement. |
| MSI installer | 0/61 | 0/75 | The earlier MSI required administrator privileges; the later one was per-user and did not require admin, according to Macea. |
| NSIS setup | 3/71 | 1/75 | Macea said the remaining result was one generic ML engine identifying the packager. |
The installer figures describe more than scan counts: the MSI’s installation privilege requirement also changed. The results do not isolate whether packaging, the underlying executable, or another build difference accounts for each outcome.
Best Value
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Check local and hosted scans separately
Macea says a build passed a local MpCmdRun scan while VirusTotal’s Microsoft engine still flagged it. In this incident, the local and hosted results did not always agree. Record which scanner checked which exact artifact instead of collapsing both outcomes into a single “clean” label.
- Scan the release artifact users will receive, not only a development build.
- Record the artifact hash, build or commit, scanner, scan date and full verdict so later results can be tied to the same file.
- Check both the local Defender result and a hosted multi-engine scan when appropriate; neither result guarantees what another scanner or a future version will report.
- Make automation distinguish a clean verdict from a failed scan, missing result or API error. Macea says his previous script had failures in both its Defender step and VirusTotal verdict handling; a failed check must not be silently labeled clean.
What to take from the incident
Macea’s central diagnostic lesson was: “Bisect, don’t theorize. My careful import-table analysis pointed at the wrong conclusion. A few rounds of git bisect pointed at the right commit.” For a developer investigating an unexplained detection, the practical sequence is to preserve the flagged artifact, compare it with a known-good build, then test the intervening project history with repeatable builds and clearly recorded scan outcomes. If a crypto implementation changes, separately prove that old encrypted data remains decryptable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute
