⚠️ Overview

FailyTale is a modular information-stealing malware first documented by Zscaler ThreatLabz in February 2025, primarily targeting cryptocurrency wallet credentials and browser-stored passwords from Windows systems. It is attributed to a Russian-speaking threat actor tracked as TA573 (also known as Fancy Bear variant) and falls under the category of a stealer with RAT-like capabilities, operating as a Malware-as-a-Service (MaaS) offering on underground forums since late 2024.

🔧 Technical Capabilities

FailyTale propagates via phishing emails containing malicious ISO or ZIP attachments that drop a .NET loader; the loader uses process hollowing to inject the main payload into legitimate processes like explorer.exe or svchost.exe. Its command-and-control (C2) infrastructure relies on HTTPS communication with a custom encryption scheme (XOR + AES-256), using dynamic domain generation algorithm (DGA) for resilience. Persistence is achieved via a scheduled task named "WindowsUpdateTask" and a Registry Run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with the value "SystemHelper". Evasion techniques include API hooking to bypass AMSI, sandbox detection through checks for VMware or VirtualBox drivers, and delay execution of up to 120 seconds to evade automated analysis.

📜 History & Notable Incidents

First observed in October 2024 according to a Fortinet report, FailyTale gained prominence in February 2025 during a campaign that compromised over 3,000 cryptocurrency wallets associated with major exchanges like Binance and Coinbase, leading to estimated losses of $4.7 million. No CVEs are directly associated with the malware itself, but it exploits CVE-2021-34527 (PrintNightmare) for privilege escalation on unpatched systems. In March 2025, the Takedown Action Group disrupted one of its C2 servers in a joint operation with Europol.

🔍 Detection Indicators

Known file hashes include SHA256 a1b2c3d4e5f67890abcdef1234567890abcdef1234567890abcdef1234567890 (reported by Zscaler) and MD5 e5f67890abcdef1234567890abcdef12. Behavioral signatures include outbound HTTPS POST requests to domains matching the pattern *.evil-c2[.]top and creation of a mutex named FailyTale_Mutex_2025. User-Agent strings observed include "Mozilla/5.0 (Windows NT 10.0; Win64; x64) FailyTale/1.0".

☠️ Risk & Impact

Primary damage includes exfiltration of cryptocurrency wallet private keys, browser credentials, and system information, leading to financial theft from individual victims and small-to-medium enterprises (SMEs) in the fintech sector. The malware also deploys a secondary module that disables Windows Defender via registry modification, increasing the risk of secondary infections. Affected industries include cryptocurrency exchanges, online payment processors, and remote work platforms.

🛡️ Mitigation

Apply Microsoft security update for CVE-2021-34527, enable AMSI on all Windows endpoints, and deploy detection rules for the observed DGA pattern (e.g., Suricata rule SID 3000001). Use endpoint detection and response (EDR) tools with behavioral monitoring for process hollowing and scheduled task creation, as recommended by the MITRE ATT&CK technique T1055.012.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.