🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eec6fb4f124564fea83670faf7b61140347020a3ca3eef052d4dc6bad4097893. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


WailsLoader


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eec6fb4f124564fea83670faf7b61140347020a3ca3eef052d4dc6bad4097893
SHA3-384 hash: 5e8cb763818d51911cecffddea60d1bc0717470020c1581eed039b6f8ea8371ccbed86a51118deb7770e21c4af176991
SHA1 hash: c057e76cfc4ecd745116195def18236f94cce6c3
MD5 hash: c3a9a58d2cf4420197ebcf473a2006a2
humanhash: fruit-alpha-tango-colorado
File name:lib.dll
Download: download sample
Signature WailsLoader
Create hunting rule
File size:550'912 bytes
First seen:2026-09-12 16:57:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 55cb668e4cb6d925853efdf5dad557bf (1 x WailsLoader)
ssdeep 12288:EFcUV3MbdrSFHj8kK6JJSkUQVnUAQcNp0nFYb9kEqVdwCmMKWCVCtY27CDkUYYF6:EFcUV3admj8kK6JJSkUQVnUpcNp0nFEk
TLSH T1C6C416A7D029129CF4FAC1BDD283A567E8A7B1188B2F55DF81B103707B586E26B7C344
TrID 51.9% (.EXE) Win64 Executable (generic) (6522/11/2)
16.1% (.EXE) OS/2 Executable (generic) (2029/13)
15.9% (.EXE) Generic Win/DOS Executable (2002/3)
15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon 700c863333860c70 (1 x WailsLoader)
Reporter ffforward
Tags:com-server dll dropped-by-wailsloader exe native-dll WailsLoader X64


Avatar
ffforward
Stage 3 64-bit native DLL dropped by AdPayWorks WailsLoader. Exports DllRegisterServer / DllGetClassObject; not standalone executable, requires COM or rundll32 hosting.

Intelligence

File Origin
# of uploads :
1
# of downloads :
168
Origin country :
SE SE
Vendor Threat Intelligence
Gathering data
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-09-12 17:06:03 UTC
Tags:
evasion websocket loader
Link:
https://app.any.run/tasks/16ba28fa-f2ee-44e8-b1d6-af5a322c788f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/85193/
Detection(s):
SecuriteInfo.com.Heur.Mint.Phil.57.45961378.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm anti-vm expand lolbin
Link:
https://www.filescan.io/uploads/6aa584d2a243c9924ef5648b/reports/5308ddb4-0687-42b0-8120-a6d729895aa1/overview
Verdict:
Malicious
Labled as:
Mint.Phil.Generic
Link:
https://www.hybrid-analysis.com/sample/eec6fb4f124564fea83670faf7b61140347020a3ca3eef052d4dc6bad4097893
Verdict:
Unknown
File Type:
dll x64
Link:
https://opentip.kaspersky.com/eec6fb4f124564fea83670faf7b61140347020a3ca3eef052d4dc6bad4097893/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/84dcdc00-16ca-4ccc-97be-5b48dfb154ad
Score:
64%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/eec6fb4f124564fea83670faf7b61140347020a3ca3eef052d4dc6bad4097893
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/c3a9a58d2cf4420197ebcf473a2006a2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eec6fb4f124564fea83670faf7b61140347020a3ca3eef052d4dc6bad4097893/
Threat name:
Win64.Trojan.MintPhil
Create hunting rule
Status:
Malicious
First seen:
2026-09-12 04:49:46 UTC
File Type:
PE+ (Dll)
Extracted files:
7
AV detection:
7 of 36 (19.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=53dpwtysivsp5kbwod5ppnqria2haifdzi7o6bjnjxdlvvajpcjq._file
Gathering data
Unpacked files
SH256 hash:
eec6fb4f124564fea83670faf7b61140347020a3ca3eef052d4dc6bad4097893
MD5 hash:
c3a9a58d2cf4420197ebcf473a2006a2
SHA1 hash:
c057e76cfc4ecd745116195def18236f94cce6c3
Link:
https://www.unpac.me/results/753b6f00-90f0-427e-9929-9b754690442f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eec6fb4f124564fea83670faf7b61140347020a3ca3eef052d4dc6bad4097893

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

WailsLoader

Executable exe 860fc154444167d8411d3796d047093ad242fcb071eb645e845ea9e048c15cb5

WailsLoader

Executable exe 603264cbf503d230902ee89324431bf3b81aebbdb31ca3cafe2deef0652405fc

WailsLoader

Executable exe eec6fb4f124564fea83670faf7b61140347020a3ca3eef052d4dc6bad4097893

(this sample)

  
Dropped by
SHA256 603264cbf503d230902ee89324431bf3b81aebbdb31ca3cafe2deef0652405fc
  
Dropped by
SHA256 1a54e8eaba82f1c52bbccb8e37078d14291204f7732e24ba8b2449f24853e9a0
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/85193/
  
Dropped by
MD5 7bcf228c5f9acc5fce436dd87d6cfff7

Comments