Behaviour.CryptoMalware

First time launching WeMod since I bought my new Antivirus - Emsisoft. When I did, I was told to quarantine it for “suspicious behaviour”, which I first ignored because I’ve seen that you guys blame this on false positives a lot. But then, when I checked the details, it said this:

11/08/2022 12:57:18

Malware “Behavior.CryptoMalware” in “C:\Users\cckke\AppData\Local\WeMod\app-8.3.2\WeMod.exe” quarantined by core

It seems to think WeMod is trying to use my pc to mine crypto. Is this just another “false positive” or is WeMod really a crypto miner?

Hello and thank you for reaching out. :slight_smile:

This is a false positive. Trainers (not just the ones from WeMod) are generally flagged as a precaution simply because of the way they work - which is by injecting code into memory addresses in your RAM that the game is running from.

WeMod has no use for crypto miners. It generates its income from Pro subscriptions, having the most competitive Pro sub price amongst all major trainer development companies.

I mean - I could understand why it would be falsely labelled as a Trojan or malware, but what would cause it to specifically detect crypto-mining malware?