What kind of shitshow is this?
Unsupported malware accusation requesting a ban. The reported EXE is byte-for-byte reproducible from the public v0.8.0 source with Go 1.26.0, producing the same SHA-256. The post shows only generic/ML detections and provides no malicious code, payload, C2, persistence mechanism or concrete IOC. Please review.You did not find a Trojan. You found six generic heuristic labels and wrote the conclusion yourself.
VirusTotal explicitly says that it “simply aggregates the output of different antivirus vendors” and does not produce its own verdict:
https://docs.virustotal.com/docs/false-positiveYour screenshot contains six unrelated generic or machine-learning labels:
W32.Malware.952F1165
Win/malicious_confidence_70% (D)
Trojan.Malware.300983.susgen
Ti!F0FE37FAD410
Trojan:Win32/Wacatac.B!ml
ML.Attribute.HighConfidence
No common malware family. No payload. No C2. No persistence mechanism. No malicious source line.
A detection is a reason to investigate. It is not permission to invent the result.
The one useful thing in your post is the executable hash:
f0fe37fad41052849df5fca627af33198bb86f1275d31474dced206831bf5b61
That exact executable is reproducible byte for byte from the public v0.8.0 source:
git clone --depth 1 --branch v0.8.0
https://github.com/petoshi/qday.git qday-v0.8.0
cd qday-v0.8.0
GOTOOLCHAIN=go1.26.0 GOOS=windows GOARCH=amd64 GOAMD64=v1 CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -H=windowsgui" -o QDAY-Wallet.exe ./node/cmd/qday-wallet
sha256sum QDAY-Wallet.exe
Result:
f0fe37fad41052849df5fca627af33198bb86f1275d31474dced206831bf5b61 QDAY-Wallet.exe
I repeated the build from a clean clone and inside the stock golang:1.26.0 Docker image. Both produced the exact executable you called a Trojan.
The executable also contains Go build metadata identifying the source revision:
vcs.revision=0a15e202d8caa00c954974f46a132004b667aa6c
vcs.modified=false
Build source:
https://github.com/petoshi/qday/blob/v0.8.0/scripts/package.py#L33-L57Successful public Windows build:
https://github.com/petoshi/qday/actions/runs/34772964790The behavior is also public. QDAY-Wallet.exe creates its application directory, starts the bundled qday-node.exe, binds its authenticated API to 127.0.0.1, opens the wallet in the default browser and lets the node connect to the QDAY peer network:
https://github.com/petoshi/qday/blob/v0.8.0/node/cmd/qday-wallet/main.go#L210-L305https://github.com/petoshi/qday/blob/v0.8.0/node/cmd/qday-wallet/platform_windows.go#L18-L35The Windows-specific launcher code contains no autostart registry key, scheduled task, service installation, process injection or executable downloader.
If your sandbox found malware, publish the evidence:
the exact registry key and operation;
the complete process command line;
the dropped file and its hash;
the external destination and responsible process;
the persistence mechanism;
or the malicious source line.
“Process, file and registry activity” without any of those details is a list of nouns, not malware analysis.
There is another problem with your report. Your QDAY ZIP link points to SHA-256:
5d780264a28a5e329e593ef9e534a7f34a3799f8246ea193f4d23be888a2c7b7
That is PCoinWallet.exe from your previous report. It is not the QDAY archive. The actual QDAY ZIP shown in your own text and screenshot is:
75b67811d1adc8abce53e2a906eff3562432bf003a9ad1711f8b257911afddd2
You copy-pasted the accusation and forgot to replace the evidence.
So either publish an actual indicator of compromise or correct the claim and the request to ban the developer. Six red pixels wearing a lab coat are still not reverse engineering.
UNBAN DOLLARDEV AND QDAY ANNOUNCE TOPIC. CORRECT THE ACCUSATION OR PUBLISH THE EVIDENCE.
