Trojan.PasswordStealer.MSLI

[Supervisor]

Situation is as follows:

Program not packed and not confused: 1/55 https://www.virustotal.com/de/file/5476ef70e82261d5e6aec153e25fc219a3a918f289debd9fd3cce1671d4a5cd6/analysis/1456315610/

(I dont bother about Qihoo-360 as it always seems to be positive most of the times I create a project in C#)

Program packed and confused with ConfuserEx 0.6: 4/55 https://www.virustotal.com/de/file/fddabddd4cd554b5081e66fc58b9f721eb0e38dd09cbba7e9a9cfddaba9f1d29/analysis/1456315526/

(Here I only bother about you guys.. -> password stealer)

Just to make sure, ConfuserEx 0.6: 0/55 https://www.virustotal.com/de/file/a55d62364f1b6b24087b4a4624fdf198ddc551782cab6044f5208b0531bbde78/analysis/1456316043/

(I know that doesnt really matter)

The problem is, https://malwr.com/is down, otherwise I would have checked in there, too...

So the question I have for you is the following:

What causes your Trojan.PasswordStealer.MSLI result? What do I have to do, so it doesnt show up as this anymore? Of course I dont want to get rid of obfuscation

I attached the obfuscated file and the result from the local scan. I may send you the non-obfuscated file privately if you'd like to see it.

Thanks

Just in case: ConfuserEx 0.6 + Source Code: https://github.com/yck1509/ConfuserEx/releases

result.txt

TSCrash 3.0.12.0.zip

[miekiemoes]

Hi,

 

We won't remove detection, but rename it to Trojan.MalPack.CNF.Generic

This exact file seems harmless itself but we won't remove detection we made for it based upon behavior and other elements, as the goal of AVs is to be proactive on certain threats especially since malware behavior is used here. This isn't only about ConfuserEx being used, but other elements in the file on top that make it suspicious.
So you can whitelist in your scanner if you don't want it to be detected.

[Supervisor]

what other elements? May I send you the non-obfuscated file?

 

Anyways, renaming it would be great. As a user I'd never run something with "PASSWORD STEALER".

[miekiemoes]

Yes, please send me a private message here with your file.