MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a901bb05c72b20363a2f25ba12a2cc67eae0f6acf031d78a2f7f2de389ed84ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

WailsLoader

Vendor detections: 12

Intelligence 12 IOCs YARA 18 File information Comments

SHA256 hash:	a901bb05c72b20363a2f25ba12a2cc67eae0f6acf031d78a2f7f2de389ed84ff
SHA3-384 hash:	ebf3578ed12987b64e165679dac07b066d9debcff3f42207af25981e57ba8c615ded1e1bd0b5f16dd1fda1388d36e26e
SHA1 hash:	c4183375cdd381cee98a7e9c3919fc9473810424
MD5 hash:	d44662469e074d6e297cdbb3b9dcbb63
humanhash:	vermont-monkey-social-maine
File name:	my_2fa_key_x.exe
Download:	download sample
Signature	WailsLoader Create hunting rule
File size:	10'424'344 bytes
First seen:	2026-10-23 17:02:18 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	c457c3a53f518626ccd02bd56edd9752 (6 x WailsLoader)
ssdeep	196608:mAJ5hg5KEXLlidW0ySN/i55CACmfoZgQwlA432qeLwhp3lki5dRKd:mAJ5hg5KE7QW0ySN/i6GfqtwqCpekhpE
TLSH	T1DAB6DF31754BC56AD06A05B01E2C9EAA93186D3A2B36A4C773DC7D5D93344C3363BEA3
TrID	29.5% (.EXE) Win64 Executable (generic) (6522/11/2) 22.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	68f6e96968b091e1 (1 x WailsLoader)
Reporter	ffforward
Tags:	exe msstore My-2FA-KeyX signed WailsLoader xpdlz63fmfkvgd

Code Signing Certificate

Organisation:	YOUR CHANCE j.d.o.o.
Issuer:	Certum Code Signing 2021 CA
Algorithm:	sha256WithRSAEncryption
Valid from:	2026-09-10T07:40:55Z
Valid to:	2027-09-10T07:40:54Z
Serial number:	433b32c5980c90c05916cf25eb0dc7a5
MalwareBazaar Blocklist:	This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Cert Graveyard Blocklist:	This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:	SHA256
Thumbprint:	980a6ccad38404410e319eed96ac32675bb8bfb3f558cbb06fa4c4cc563edb8c
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

ffforward

Trojanized Wails desktop app (My 2FA KeyX v1.2.1) distributed via official Microsoft Store (Product ID: xpdlz63fmfkvgd, Publisher: Alisoftware [95875250]). Signed by YOUR CHANCE j.d.o.o. (Certum).

Intelligence

File Origin

# of uploads :

# of downloads :

184

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-10-23 17:14:29 UTC

Tags:

advancedinstaller auto-reg golang telegram

Link:

https://app.any.run/tasks/57271560-3c30-4e9c-8a65-d4a6bc7b11b2

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/94271/

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6adb93205a22ac805bd9dc25

Tags:

ransomware dropper virus

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating a window

Creating synchronization primitives

Creating a file in the %AppData% subdirectories

Searching for synchronization primitives

Creating a file in the %temp% directory

Deleting a recently created file

Loading a suspicious library

Launching a process

Modifying a system file

Creating a file in the Windows subdirectories

Creating a file

Creating a process from a recently created file

Sending a custom TCP request

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

adaptive-context adaptive-context anti-debug anti-vm base64 evasive expand fingerprint installer-heuristic lolbin microsoft_visual_cc msiexec overlay packed reconnaissance runonce signed

Link:

https://www.filescan.io/uploads/6adb936cd8845f0625acf83b/reports/450d87df-056e-4ba3-8d04-0db24f1cf8bd/overview

Verdict:

Suspicious

Labled as:

Tool.Patcher

Link:

https://www.hybrid-analysis.com/sample/a901bb05c72b20363a2f25ba12a2cc67eae0f6acf031d78a2f7f2de389ed84ff

Verdict:

Unknown

File Type:

exe x32

First seen:

2026-10-23T14:38:00Z UTC

Last seen:

2026-10-25T06:05:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/a901bb05c72b20363a2f25ba12a2cc67eae0f6acf031d78a2f7f2de389ed84ff/results?tab=lookup

Malware family:

Utility for conversion Mozlz4 to JSON

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/87ef4506-24aa-4999-bdb4-1f7d54a57841

Score:

61%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/a901bb05c72b20363a2f25ba12a2cc67eae0f6acf031d78a2f7f2de389ed84ff

Verdict:

inconclusive

YARA:

6 match(es)

Tags:

CAB:COMPRESSION:MSZIP Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/d44662469e074d6e297cdbb3b9dcbb63

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a901bb05c72b20363a2f25ba12a2cc67eae0f6acf031d78a2f7f2de389ed84ff/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vea3wbohfmqdmorpew5bfiwmm7vob5vm6ay5pcrpp4w6hcpnqt7q._file

Verdict:

malicious

Label(s):

WailsLoader

Link:

https://reports.threatray.com/274d526d-5094-454e-a06d-fc646dc8c761

Result

Malware family:

wailsloader

Score:

10/10

Tags:

family:wailsloader defense_evasion discovery downloader loader trojan

Link:

https://tria.ge/reports/261023-vj93gscx9s/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Checks whether UAC is enabled

Enumerates connected drives

Network Share Discovery

Executes dropped EXE

Loads dropped DLL

Detects WailsLoader

Family: WailsLoader

Unpacked files

SH256 hash:

a901bb05c72b20363a2f25ba12a2cc67eae0f6acf031d78a2f7f2de389ed84ff

MD5 hash:

d44662469e074d6e297cdbb3b9dcbb63

SHA1 hash:

c4183375cdd381cee98a7e9c3919fc9473810424

Link:

https://www.unpac.me/results/651fe82b-6552-4162-b03d-c65a851a0f50/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a901bb05c72b20363a2f25ba12a2cc67eae0f6acf031d78a2f7f2de389ed84ff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	certum_issuer Create hunting rule
Author:	Certum
Description:	Looks for files signed with certificate issued by Certum

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	detect_certum_issuer Create hunting rule
Author:	Certum
Description:	Looks for files signed with certificate issued by Certum

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	JP_Lure_Content_Hunt Create hunting rule
Author:	sumeshi
Description:	Hunts for files containing Japanese kana text or common Japanese lure terminology

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	WIN_Malware_Unknown_ForgeAuto_2e3a5916_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_30f84f37 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_37b4704b Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_74566f98 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_79234c04 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_9045187c Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_92a28498 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

WailsLoader

exe a901bb05c72b20363a2f25ba12a2cc67eae0f6acf031d78a2f7f2de389ed84ff

(this sample)

WailsLoader

exe 137378852febadf6ad9db67eb5a1dd4255611c7f82465d6a9e182a3373636a3d

Link

https://apps.microsoft.com/detail/xpdlz63fmfkvgd

URLhaus

https://tax.eatleanbeans.com/down/1.2.1/my_2fa_key_x.exe

Dropping

SHA256 137378852febadf6ad9db67eb5a1dd4255611c7f82465d6a9e182a3373636a3d

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/94271/

Dropping

MD5 009e90fd0de9db004658827d4f9c2fd0

URLhaus

https://urlhaus.abuse.ch/url/3969466/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample