see my reply #16

and the file name shown in VT scan (bot.exe) does not mean much …
if i still had that sample i could have uploaded it again and called it Michael