False (?) positive on BitTorrent installer about loki

[Neo23x0]

Hi Michael.

LOKI is not meant to be an Antivirus alternative.
It does not modify, delete or clean objects on disk.
I intentionally designed it to be more verbose and report "suspicious" elements. This is something an Antivirus can not do, as it works independently and has to decide between "black" and "white" in order to delete or clean the element.

"One could be tempted to believe that I wrote this article in order to degrade Antivirus engines, but this isn’t the case. Antivirus solutions are still play a key role and carry the heavy burden of definite detection. Their scan result has to be „thumbs up“ or „thumbs down“ as there is no middle ground.

Years ago they introduced signatures to detect „Potentially Unwanted Applications“ (PUA). Users or administrators decide on what to do if one of these „dual use“ tools has been found on a system. Handling thousands of the events generated by the Antivirus agents is a difficult task, even with a central console or SIEM integrated log files. It is easy to understand why PUA events do not play an important role in view of dozens of Trojan detections per day."

https://www.bsk-consulting.de/2015/03/10/apt-detection-is-about-metadata/

I would like to leave the rule in the rule base.
The file does contain a base64 encoded executable, which is very suspicious and should be reviewed by the users (home env) or security analyst (corporate env).