VirusTotal flagged Subloader as malicious

[earmin]

SubloaderV163Portable.exe
SubloaderWpf.dll
a576057cbc04ac300480d7d9a49dfd60bae3a2c45bb1000089d736f8e745fb63

[Valyreon]

Hi, so it turns out that .NET single-file/portable publishing is a known false-positive trigger. The embedded assemblies, and runtime behavior look exactly like a dropper to ML engines but this is what enables it to be run without installing anything.

I tried it on the regular exe file from installation that doesn't include the framework and it returned one malicious result:

Probably because non-framework assemblies are still packed in the exe file. It's more convenient that way because it's a very small app.

I am going to look into this sometimes, what I can do about it. But if you are concerned and still want to use the app you are free to review the code and build it yourself.