Malware

AVCheck

AVCheck is a counter-antivirus service used by cybercriminals to test or validate malicious files against antivirus detection. The provided reporting identifies it as one of the larger criminal services of this type and states that authorities in the United States, Finland, and the Netherlands coordinated a takedown of its infrastructure. It is referenced alongside other disrupted cybercrime services and malware ecosystems, indicating its role as enabling infrastructure for broader criminal operations rather than as a standalone malware family. No specific infection vector, malware platform, targeted industry, technical behavior, or indicators of compromise are provided in the content.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

1 distinct technique documented for this family, organized by ATT&CK tactic.

Stealth

1 technique

T1497Virtualization/Sandbox EvasionEvidence1

Like many threat actors deploying malware or related infrastructure, Lumma affiliates actively seek tools to test detection beyond standard sandbox environments.

Discovery

1 technique

T1497Virtualization/Sandbox EvasionEvidence1

Like many threat actors deploying malware or related infrastructure, Lumma affiliates actively seek tools to test detection beyond standard sandbox environments.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyberscoopNews

Mar 20, 2026

Justice Department disrupts botnet networks that hijacked 3 million devices | CyberScoop

Mentioned as a named cybercrime tool or malicious service disrupted in the broader crackdown, but no further technical detail is provided in the content.

cso onlineNews

Dec 23, 2025

Interpol sweep takes down cybercrooks in 19 countries

AVCheck is a counter-antivirus service used by cybercriminals to test malware samples against antivirus products to evade detection.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping1

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.