Easy RSA Flagged as trojan/ransomware #1388
Description
I have tried to set up a VPN Connection for zero trust connection from my laptop to a new server.
Downloading the RSA versions 3.2.3 or 3.2.4 from https://github.com/OpenVPN/easy-rsa/releases is not possible in Chrome or Edge with safe browsing on because they are flagged as malware. Having worked with prior versions and trusting them, I thought nothing of it (false positive) and just deactivated safe browsing for the download. Additionally, it is a new server without any data, so there is nothing dangerous yet.
Lo and behold, windows defender quarantines the downloaded zip-files. Again, I cautiously ignored it and installed it anyways. Now my CyberProtect System also flagged first of all the zip-file again, some cached files from the chrome download and another file in my VPN setup: "C:\Program Files\OpenVPN\easy-rsa\libcrypto-3-x64.dll".
The files are now quarantined and the VPN does not work anymore.
A check with virustotal shows the following:
The zip-file is flagged by 33/68 vendors with the following flags:
Popular threat label: trojan.pigyx/usblh925
Threat categories: trojan, ransomware
Family labels: pigyx, usblh925
The dll-file is flagged by 36/72 vendors with the exact same flags as the zip-file.
Testing this with the zip-file version 3.2.2 has only one vendor flagging it and no files are quarantined by my Cyberprotect.
Why could this be?