Malware

Trojan.Win64.KILLLAV.I

Trojan.Win64.KILLLAV.I is a defense-evasion utility observed in Warlock ransomware intrusion chains. Trend Micro reported that attackers deployed this binary, including under the filename vmtools.exe, to enumerate running processes and terminate selected processes listed in a log file, primarily targeting security software. In the observed cases, the targeted processes were associated with Trend Micro security products. The malware was used after initial access in campaigns exploiting vulnerable on-premises Microsoft SharePoint servers, including attacks linked in reporting to Storm-2603 and broader Warlock activity. Within those intrusions, attackers used it alongside other post-compromise actions such as privilege escalation through Group Policy changes, activation of the built-in guest account with elevated privileges, command-and-control via Cloudflare Tunnel, credential dumping with Mimikatz, lateral movement over SMB, and eventual ransomware deployment. High-confidence identifiers from the content include the detection name Trojan.Win64.KILLLAV.I and the observed filename vmtools.exe.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1543.003Windows ServiceEvidence1

KILLLAV installs its decrypted driver as a service named googleApiUtil64.

Privilege Escalation

1 technique

T1543.003Windows ServiceEvidence1

KILLLAV installs its decrypted driver as a service named googleApiUtil64.

Stealth

1 technique

T1014RootkitEvidence1

It drops an encrypted driver file, decrypts it, writes it as googleApiUtil64.sys, and uses the previously installed malicious driver to forcibly terminate target processes.

Discovery

1 technique

T1057Process DiscoveryEvidence1

The KILLLAV binary enumerates all running processes and compares their names to a target list; the actors also run tasklist /svc.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

The batch script copies vmtools.exe, log.bat, and files from a remote share—including the ransomware binary—to the Public folder.

Impact

1 technique

T1489Service StopEvidence1

The batch file employs taskkill commands to forcibly terminate Trend processes; the ransomware also terminated security, backup, database, and recovery services.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

trend micro researchNews

Aug 20, 2025

Warlock: From SharePoint Vulnerability Exploit to Enterprise Ransomware

Trojan.Win64.KILLLAV.I is a custom malware used for defense evasion in ransomware attacks. It enumerates and terminates security software processes, drops and installs a malicious driver, and repeatedly kills targeted processes to facilitate ransomware deployment.

dark readingNews

Aug 20, 2025

How Warlock Ransomware Targets Vulnerable SharePoint Servers

Process-termination tool used for defense evasion by enumerating and killing security-related processes (notably targeting Trend Micro security product processes in the observed activity).

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Trojan.Win64.KILLLAV.I