IVPN vpn, wireguard.exe detected as HEUR:Trojan.Win32.Cobalt.vho

[leroy]

recently upgrade my vpn app IVPN  when kaspersky total security flagged it as HEUR:Trojan.Win32.Cobalt.vho i think this is a false flag but would like to get to the bottom of this

Event: Malicious object detected
Component: Application Control
Result description: Detected
Type: Trojan
Name: HEUR:Trojan.Win32.Cobalt.vho
Threat level: High
Object path: C:\Program Files\IVPN Client\WireGuard\x86_64
Object name: wireguard.exe
Reason: Machine learning
Databases release date: Yesterday, 09/11/2021 17:56:00

[Igor Kurzin]

Hi @leroy , 

Can you tell which version of IVPN is detected? 

If possible, upload the detected file here: https://opentip.kaspersky.com  and press “Submit to reanalyze” to report a possible false detection. 

[leroy]

thanks igor i have reported it on there and uploaded the file 🙂

[leroy]

and the version is IVPN-Client-v3.4.0.

[Igor Kurzin]

Hi @leroy , 

Downloaded the IVPN-Client-v3.4.0, scanned it, and no detections… probably have to follow the ‘upgrade from previous version’ scenario to reproduce this. Let’s wait what happens with your submission at opentip.kaspersky.com… 

[leroy]

hi Igor have not had any problems with it getting flagged up so fingers crossed and thank you very much for you help😌