MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73cb8ff57d809fe1042ef02ba5571d8ad7ee871cadf01a9bbc609f69f8d407ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

WailsLoader

Vendor detections: 10

Intelligence 10 IOCs YARA 14 File information Comments

SHA256 hash:	73cb8ff57d809fe1042ef02ba5571d8ad7ee871cadf01a9bbc609f69f8d407ed
SHA3-384 hash:	cd2165d56d21efe33d37b5ad215e54c6605d521e9d78ef443bb2a4031a01dbb548b3eb360030d9978603f0e62f6960de
SHA1 hash:	61f03e7ac3bce8395a27352b0e4f73b41d5def84
MD5 hash:	9f4b2e1530ee264f07e06c8950e2748f
humanhash:	failed-mountain-low-vermont
File name:	qr2auth.exe
Download:	download sample
Signature	WailsLoader Create hunting rule
File size:	10'446'288 bytes
First seen:	2026-10-15 23:21:42 UTC
Last seen:	2026-10-16 23:42:26 UTC
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	c457c3a53f518626ccd02bd56edd9752 (5 x WailsLoader)
ssdeep	196608:EAJ5hg5KEXLlidW0ySN/i55CACmQWkINlEyzSxO44ss9MCpd5h6YV6QwyDxO7n2X:EAJ5hg5KE7QW0ySN/i6GQc/DWxO4MhtZ
TLSH	T18CB6BE31F54ACC66D0EE05BC1E289F5AC2386D2A2B2544C373FE7B5D56764C2363AB12
TrID	29.5% (.EXE) Win64 Executable (generic) (6522/11/2) 22.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	6d6de9c7b1b0a2c0 (8 x WailsLoader, 1 x ConnectWise, 1 x NetSupport)
Reporter	ffforward
Tags:	exe QR2-Auth signed WailsLoader XP9M1JZ5PF49KC

Code Signing Certificate

Organisation:	Adelise Zoe Hernandez Melendez
Issuer:	SSL.com Code Signing Intermediate CA RSA R1
Algorithm:	sha256WithRSAEncryption
Valid from:	2026-09-07T17:26:07Z
Valid to:	2027-09-07T17:26:07Z
Serial number:	1f2f4ddc5d24a208df6d068654f265bb
Cert Graveyard Blocklist:	This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:	SHA256
Thumbprint:	259ec816e92b5919d5c48bb89c41ea9bec731bdd484b554c22689066ad083953
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

ffforward

Trojanized Wails desktop app distributed via official Microsoft Store (Product ID: XP9M1JZ5PF49KC, Publisher ID: 95818300 Nazardevelop). Signed by Adelise Zoe Hernandez Melendez (SSL.com, valid to Sept 2027). Active C2 ftp.mawar180.org via Telegram DDR +P80BUB3VtLhhMmUy.

Intelligence

File Origin

# of uploads :

# of downloads :

215

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-10-15 23:24:05 UTC

Tags:

advancedinstaller golang

Link:

https://app.any.run/tasks/9fdbfc15-0df9-47ff-a819-48498e5d104f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/92194/

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad1b0e06f551121ba167e6f

Tags:

ransomware dropper virus

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating a window

Creating synchronization primitives

Creating a file in the %AppData% subdirectories

Searching for synchronization primitives

Creating a file in the %temp% directory

Deleting a recently created file

Loading a suspicious library

Launching a process

Modifying a system file

Creating a file in the Windows subdirectories

Creating a file

Creating a process from a recently created file

Sending a custom TCP request

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

adaptive-context adaptive-context anti-debug anti-vm base64 expand fingerprint installer-heuristic lolbin microsoft_visual_cc msiexec overlay packed reconnaissance runonce signed

Link:

https://www.filescan.io/uploads/6ad160347312e817f5678ca8/reports/8b5cb14f-1bba-4066-8846-36a2f11e712e/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/73cb8ff57d809fe1042ef02ba5571d8ad7ee871cadf01a9bbc609f69f8d407ed

Verdict:

Clean

File Type:

exe x32

First seen:

2026-09-24T17:29:00Z UTC

Last seen:

2026-10-17T20:28:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/73cb8ff57d809fe1042ef02ba5571d8ad7ee871cadf01a9bbc609f69f8d407ed/results?tab=lookup

Malware family:

Utility for conversion Mozlz4 to JSON

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/09ab0295-3f64-4450-b0eb-18e1cb51a111

Score:

63%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/73cb8ff57d809fe1042ef02ba5571d8ad7ee871cadf01a9bbc609f69f8d407ed

Verdict:

inconclusive

YARA:

6 match(es)

Tags:

CAB:COMPRESSION:MSZIP Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/9f4b2e1530ee264f07e06c8950e2748f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/73cb8ff57d809fe1042ef02ba5571d8ad7ee871cadf01a9bbc609f69f8d407ed/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=opfy75l5qcp6cbbo6av2kvy5rll65by4vxybvg54mcpwt6gua7wq._file

Verdict:

malicious

Label(s):

WailsLoader

Link:

https://reports.threatray.com/ca1a3b62-6dc1-48fe-a396-006ac4edc609

Result

Malware family:

wailsloader

Score:

10/10

Tags:

family:wailsloader defense_evasion discovery downloader loader trojan

Link:

https://tria.ge/reports/261015-3cqz2aes3z/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Checks whether UAC is enabled

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Network Share Discovery

Detects WailsLoader

Family: WailsLoader

Unpacked files

SH256 hash:

73cb8ff57d809fe1042ef02ba5571d8ad7ee871cadf01a9bbc609f69f8d407ed

MD5 hash:

9f4b2e1530ee264f07e06c8950e2748f

SHA1 hash:

61f03e7ac3bce8395a27352b0e4f73b41d5def84

Link:

https://www.unpac.me/results/1ba86808-6e10-4fe7-9369-32811568b3e8/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/73cb8ff57d809fe1042ef02ba5571d8ad7ee871cadf01a9bbc609f69f8d407ed

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	WIN_Malware_Unknown_ForgeAuto_2e3a5916_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_30f84f37 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_37b4704b Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_74566f98 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_79234c04 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_92a28498 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

WailsLoader

exe 73cb8ff57d809fe1042ef02ba5571d8ad7ee871cadf01a9bbc609f69f8d407ed

(this sample)

WailsLoader

exe 675971cc1e2c889b2804336626f4e2d1489b7878c15817b57847d1d88347b76c

Link

https://apps.microsoft.com/detail/xp9m1jz5pf49kc

Link

https://cdn.storeedgefd.dsx.mp.microsoft.com/eus2/cachedpackages/95818300/eafabfed-ec01-47da-879e-a18fde4b8eb1/73cb8ff57d809fe1042ef02ba5571d8ad7ee871cadf01a9bbc609f69f8d407ed/file

Dropping

SHA256 675971cc1e2c889b2804336626f4e2d1489b7878c15817b57847d1d88347b76c

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/92194/

Dropping

MD5 7500d0d6eeeda52ed769057153e6c1bb

URLhaus

https://urlhaus.abuse.ch/url/3950710/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample