My acc and QDAY ann topic were banned over an unsupported malware accusation

[antialbon]

His explanation https://bitcointalk.org/index.php?topic=5182222.msg67144459#msg67144459
My Evidence https://bitcointalk.org/index.php?topic=5182222.msg67144967#msg67144967

This Newbie member promoted [QDAY] The PoW Coin and uploaded the project's wallet to GitHub yesterday. After checking the wallet, I found that it contains a Trojan, and 6/70 security vendors flagged the file as malicious. Sandbox analysis also shows suspicious process, file, and registry activity.

https://www.talkimg.com/images/2026/09/14/UqTNQq.png |[ARCHIVED]

Popular threat label: trojan.

Threat categories: trojan

Family labels: trojan

File Information:

Code:

[+] File Name: QDAY-Wallet-0.8.0-mainnet-windows-amd64.zip
[+] SHA-256: 75b67811d1adc8abce53e2a906eff3562432bf003a9ad1711f8b257911afddd2

[+] File Name: QDAY-Wallet.exe
[+] SHA-256: f0fe37fad41052849df5fca627af33198bb86f1275d31474dced206831bf5b61

https://www.talkimg.com/images/2026/09/14/UqTTT2.png

https://www.talkimg.com/images/2026/09/14/UqTt1c.png

Github : https_://github.com/petoshi/qday/releases | https_://pqday.com

ANN threads:

[1] [QDAY] The PoW coin that outlives crypto.

User: DollarDev <----- Please ban this user.

Archived ANN thread: https://ninjastic.space/post/67132568

VirusTotal Scan Results:
[1] (6/70)
[2] QDAY-Wallet-0.8.0-mainnet-windows-amd64.zip (2/67)

What kind of shitshow is this?

Unsupported malware accusation requesting a ban. The reported EXE is byte-for-byte reproducible from the public v0.8.0 source with Go 1.26.0, producing the same SHA-256. The post shows only generic/ML detections and provides no malicious code, payload, C2, persistence mechanism or concrete IOC. Please review.

You did not find a Trojan. You found six generic heuristic labels and wrote the conclusion yourself.

VirusTotal explicitly says that it “simply aggregates the output of different antivirus vendors” and does not produce its own verdict:

https://docs.virustotal.com/docs/false-positive

Your screenshot contains six unrelated generic or machine-learning labels:

W32.Malware.952F1165
Win/malicious_confidence_70% (D)
Trojan.Malware.300983.susgen
Ti!F0FE37FAD410
Trojan:Win32/Wacatac.B!ml
ML.Attribute.HighConfidence

No common malware family. No payload. No C2. No persistence mechanism. No malicious source line.

A detection is a reason to investigate. It is not permission to invent the result.

The one useful thing in your post is the executable hash:

f0fe37fad41052849df5fca627af33198bb86f1275d31474dced206831bf5b61

That exact executable is reproducible byte for byte from the public v0.8.0 source:

git clone --depth 1 --branch v0.8.0 https://github.com/petoshi/qday.git qday-v0.8.0
cd qday-v0.8.0
GOTOOLCHAIN=go1.26.0 GOOS=windows GOARCH=amd64 GOAMD64=v1 CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -H=windowsgui" -o QDAY-Wallet.exe ./node/cmd/qday-wallet
sha256sum QDAY-Wallet.exe

Result:

f0fe37fad41052849df5fca627af33198bb86f1275d31474dced206831bf5b61  QDAY-Wallet.exe

I repeated the build from a clean clone and inside the stock golang:1.26.0 Docker image. Both produced the exact executable you called a Trojan.

The executable also contains Go build metadata identifying the source revision:

vcs.revision=0a15e202d8caa00c954974f46a132004b667aa6c
vcs.modified=false

Build source:
https://github.com/petoshi/qday/blob/v0.8.0/scripts/package.py#L33-L57

Successful public Windows build:
https://github.com/petoshi/qday/actions/runs/34772964790

The behavior is also public. QDAY-Wallet.exe creates its application directory, starts the bundled qday-node.exe, binds its authenticated API to 127.0.0.1, opens the wallet in the default browser and lets the node connect to the QDAY peer network:

https://github.com/petoshi/qday/blob/v0.8.0/node/cmd/qday-wallet/main.go#L210-L305
https://github.com/petoshi/qday/blob/v0.8.0/node/cmd/qday-wallet/platform_windows.go#L18-L35

The Windows-specific launcher code contains no autostart registry key, scheduled task, service installation, process injection or executable downloader.

If your sandbox found malware, publish the evidence:

the exact registry key and operation;
the complete process command line;
the dropped file and its hash;
the external destination and responsible process;
the persistence mechanism;
or the malicious source line.

“Process, file and registry activity” without any of those details is a list of nouns, not malware analysis.

There is another problem with your report. Your QDAY ZIP link points to SHA-256:

5d780264a28a5e329e593ef9e534a7f34a3799f8246ea193f4d23be888a2c7b7

That is PCoinWallet.exe from your previous report. It is not the QDAY archive. The actual QDAY ZIP shown in your own text and screenshot is:

75b67811d1adc8abce53e2a906eff3562432bf003a9ad1711f8b257911afddd2

You copy-pasted the accusation and forgot to replace the evidence.

So either publish an actual indicator of compromise or correct the claim and the request to ban the developer. Six red pixels wearing a lab coat are still not reverse engineering.

UNBAN DOLLARDEV AND QDAY ANNOUNCE TOPIC. CORRECT THE ACCUSATION OR PUBLISH THE EVIDENCE.

[albon]

I corrected the VirusTotal ZIP link.

I agree that VirusTotal detections alone are not enough to prove a Trojan. My report was based on those detections and the sandbox behavior I saw when I tested the program.

I am currently doing a closer look of the sandbox results, including processes, registry, files and network activity, not just relying on the AV detections.

If I find that the behavior is harmless, I will correct my conclusion and update this post.

[antialbon]

I corrected the VirusTotal ZIP link.

I agree that VirusTotal detections alone are not enough to prove a Trojan. My report was based on those detections and the sandbox behavior I saw when I tested the program.

I am currently doing a closer look of the sandbox results, including processes, registry, files and network activity, not just relying on the AV detections.

If I find that the behavior is harmless, I will correct my conclusion and update this post.

Thanks

[joker_josue]

I just didn't notice one thing.

If you've been on the forum for 11 years, how did the DollarDev account come about in 2026?

After all, who are you really?

My account DollarDev was banned following that report. I created this account only to provide reproducible-build evidence and request a review.

P.s.

I don’t know when Bitcointalk, the best Bitcoin forum on the internet, stopped thinking for itself. Even Legendary members are doing Newbie-tier analysis now. Maybe it happened when somebody handed everyone AI tools and forgot to explain that copying output is not the same thing as understanding it. I’ve been around this forum since 2011. Watching it degrade into copy-paste paranoia is fucking embarrassing.

[antialbon]

I just didn't notice one thing.

If you've been on the forum for 11 years, how did the DollarDev account come about in 2026?

After all, who are you really?

My account DollarDev was banned following that report. I created this account only to provide reproducible-build evidence and request a review.

P.s.

I don’t know when Bitcointalk, the best Bitcoin forum on the internet, stopped thinking for itself. Even Legendary members are doing Newbie-tier analysis now. Maybe it happened when somebody handed everyone AI tools and forgot to explain that copying output is not the same thing as understanding it. I’ve been around this forum since 2011. Watching it degrade into copy-paste paranoia is fucking embarrassing.

What difference does it make? I said I’ve been around this forum since 2011, not that DollarDev acc has been. Let’s stick to the actual situation.

[joker_josue]

What difference does it make? I said I’ve been around this forum since 2011, not that DollarDev acc has been. Let’s stick to the actual situation.

You're really very nervous about the situation, take a deep breath and try to deal with it in another way.

[albon]

I finished the additional checks now and I didn't find any sign of anything making it start automatically,, seed or login data being stolen, suspicious files being run, or data being sent somewhere.

As I saw, the successful external connections I observed looked consistent with QDAY's P2P traffic on port 19771.

I also checked the 198.18.x.x connections that looked suspicious at first. They were still unsuccessful SYN attempts so I was not able to confirm that they were malicious connections.

Based on this, I cannot confirm my original statement that the wallet contains a Trojan, So I am withdrawing that conclusion.

My original conclusion was based on the VirusTotal result, but those detections alone are not enough to prove that the wallet is malicious.

I am posting the screenshots from my tests so you can review the evidence and make up your own mind.



^{Note: This does not mean the wallet is 100% safe.}

I will therefore correct my report, since the extra checks didn't support my original conclusion.

[joker_josue]

My original conclusion was based on the VirusTotal result, but those detections alone are not enough to prove that the wallet is malicious.

I think it's already been mentioned how easy it is to get false positives on VirusTotal and similar services.

The analysis should go beyond simply running VirusTotal checks, especially if the final recommendation is to "ban".

[albon]

I think it's already been mentioned how easy it is to get false positives on VirusTotal and similar services.

The analysis should go beyond simply running VirusTotal checks, especially if the final recommendation is to "ban".

I agree with you on that. That’s why I corrected my Previous conclusion after doing some additional testing, which took me some time.

The VirusTotal results alone were not enough to support the Trojan claim, so I took that back and posted the results of my new tests for everyone to review. The new report only includes the evidence I was able to verify.

I also updated the original report in the other thread --> https://bitcointalk.org/index.php?topic=5182222.msg67144459#msg67144459

I also removed the negative trust from his other account.

[antialbon]

I think it's already been mentioned how easy it is to get false positives on VirusTotal and similar services.

The analysis should go beyond simply running VirusTotal checks, especially if the final recommendation is to "ban".

I agree with you on that. That’s why I corrected my Previous conclusion after doing some additional testing, which took me some time.

The VirusTotal results alone were not enough to support the Trojan claim, so I took that back and posted the results of my new tests for everyone to review. The new report only includes the evidence I was able to verify.

I also updated the original report in the other thread --> https://bitcointalk.org/index.php?topic=5182222.msg67144459#msg67144459

I also removed the negative trust from his other account.

Thank you for taking time to verify wallet and correct the original report. I respect that. However, my DollarDev account is still banned, and the QDAY announcement topic is still removed:=)

Moderators, Please review the case, unban DollarDev, and restore the QDAY announcement topic.

[antialbon]

Thank you for ruining the launch. QDAY fell from 16 TH/s to 500 GH/s in two days over a false “Trojan” claim.
There is no need to restore the old announcement now. I recreated it from this account.