Loading malware…
AVKiller is an antivirus termination utility observed as a malware payload in multiple ransomware intrusions. The provided reporting describes it as a lesser-prevalent AV killer tool and antivirus termination program that was detected during ongoing ransomware attacks, including incidents involving RansomHub and MedusaLocker. Sophos observed HeartCrypt-packed AVKiller payloads, including a VMProtect-packed variant, indicating it can be delivered through the HeartCrypt packer-as-a-service ecosystem used by multiple threat actors. Its stated purpose is to evade endpoint defenses by targeting and disabling security products; specifically, reported targets included ESET, HitmanPro, Kaspersky, Sophos, and Symantec. The content also notes broader researcher observations of shared AVKiller utilities and newer malware variants leveraging vulnerable kernel drivers to bypass endpoint protections. High-confidence context ties AVKiller to ransomware operations and defense evasion rather than initial access, but no standalone infection vector, persistence mechanism, or specific IOC set for AVKiller itself is provided in the content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...researchers observing shared ‘AVKiller’ utilities and newer malware variants leveraging vulnerable kernel drivers to evade endpoint defenses.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Utility/tooling used to disable or evade security controls (e.g., AV/EDR), including via vulnerable kernel driver abuse (BYOVD) as part of ransomware intrusion tradecraft.
Malware designed to terminate antivirus processes, often used as part of multi-stage attacks to disable security defenses.
A security-tool disabling payload delivered by HeartCrypt, often VMProtect-packed, used to target and disable endpoint protection products and observed during active ransomware intrusions.
A security-tool disabling payload delivered by HeartCrypt. It is used to target and disable endpoint protection products and was observed during ongoing ransomware attacks.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.