[Bish0pQ]

An AV is fine, but if an AV detects it as a virus it would necessarly mean that it is a virus.

Run it in a VM, also run the file sandboxed and record the traffic with Fiddler (if on Windows) otherwise use something like Wireshark.
Also, it can also be something else than a password stealer/RAT. It's also possible that a coinminer gets installed, so if you notice you're PC/VM is getting slow, than that might be the reason for it.