I really disagree with you on this. The problem is not the person who researches different exploits (ie who may /write/ the malware) but with the people who /use/ the malware to do bad things.

When we keep preventing white hat researchers from doing their job, there's no defense against black hats.

If he actually sold Kronos for the sole purpose of stealing, I agree that he should be prosecuted. If he only used it for research purposes, this is a complete witch hunt.