Trojan Trigger

[Mobeeuz]

Name: Trojan-Downloader.Win64.Alien.eaa
Precision: Exactly
Threat level: High
Object type: File
Object name: netmon.exe
MD5 of an object: 48322689581BB34B12EA94D150BB7943

[decoded-cipher]

Thanks for the report! This is a false positive from heuristic antivirus detection.

netmon.exe is a Go-based network monitor. The "Trojan-Downloader" classification might be triggered because the app downloads data from Cloudflare's public speed test endpoint (speed.cloudflare.com/__down) to measure internet speed — a behavior that AV heuristics pattern-match as "trojan downloader."

[decoded-cipher]

Checked both Windows release builds on VirusTotal.

The ARM64 build is 0/75 — fully clean. The AMD64 build is 3/75, flagged by Bkav, CrowdStrike, and Elastic. The sandbox behavior analysis for the AMD64 build confirms it only contacts speed.cloudflare.com:443 for the speed test, and writes only the local SQLite database.

Full source is in this repo and can be built and verified independently.

https://www.virustotal.com/gui/file/41d236479d33204fa14ec2244e55408f4f260891b806a5b8b63b54fbf8bcc123/detection)
https://www.virustotal.com/gui/file/ddca5ae774e623dcf842a9a22156ee67f528cd0f0c6b4b2087c7e0d122384ad4/detection

[decoded-cipher]

Even though this is a false positive, we take these reports seriously. We'll be looking into ways to reduce or eliminate AV detections for future releases — common approaches include code signing the binary and submitting false positive reports to the affected vendors (Bkav, CrowdStrike, Elastic).

If anyone has experience dealing with AV false positives for Go binaries on Windows, we'd love to hear your suggestions!