Malware

MalVirt

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583Acquire InfrastructureEvidence1

SentinelLABS observed a cluster of virtualized .NET malware loaders distributed through malvertising attacks.

Persistence

1 technique

T1543.003Windows ServiceEvidence1

0onfirm then deploys the driver by creating a service named TaskKill.

Privilege Escalation

2 techniques

T1068Exploitation for Privilege EscalationEvidence2

This technique is commonly referred to as a “bring your own vulnerable driver” (BYOVD) attack.

T1543.003Windows ServiceEvidence1

0onfirm then deploys the driver by creating a service named TaskKill.

Stealth

5 techniques

T1014RootkitEvidence1

Malware in general uses the Process Explorer driver to conduct activities with kernel privileges, such as killing processes of detection mechanisms to evade detection or duplicating process handles for tampering.

T1027Obfuscated Files or InformationEvidence1

some strings (such as amsi.dll and AmsiScanBuffer) are Base-64 encoded and AES-encrypted.

T1497Virtualization/Sandbox EvasionEvidence1

We also observed MalVirt samples evaluating whether they are executing within a virtual machine or an application sandbox environment.

T1497.001System ChecksEvidence1

evaluating the presence of the drivers vboxmouse.sys, vmmouse.sys, and vmhgfs.sys on victim systems.

T1620Reflective Code LoadingEvidence1

When executed, a MalVirt sample reflectively loads an assembly, such as 0onfirm, which further orchestrates the staging of the final payload.

Discovery

3 techniques

T1012Query RegistryEvidence1

detecting the VirtualBox and VMWare environments involves querying the registry keys HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest and HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools

T1497Virtualization/Sandbox EvasionEvidence1

We also observed MalVirt samples evaluating whether they are executing within a virtual machine or an application sandbox environment.

T1497.001System ChecksEvidence1

evaluating the presence of the drivers vboxmouse.sys, vmmouse.sys, and vmhgfs.sys on victim systems.

Impact

1 technique

T1489Service StopEvidence1

The second type of function takes a list of vendors’ related process names as an argument... if a process name is included in this list, AuKill attempts to forcefully terminate it via TerminateProcess.

Other

2 techniques

T1562.001Disable or Modify ToolsEvidence2

some samples patch the AmsiScanBuffer function implemented in amsi.dll to bypass the Anti Malware Scan Interface (AMSI) | The name TaskKill indicates the potential malicious use of Иисус.sys – process termination with kernel privileges.

T1562Impair DefensesEvidence1

Over the past several months, Sophos X-Ops has investigated multiple incidents where attackers attempted to disable EDR clients with a new defense evasion tool we’ve dubbed AuKill.

INDICATORS OF COMPROMISE

IOCs tracked for this family

20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

17 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

sentinelone labsNews

Apr 11, 2025

MalVirt | .NET Virtualization Thrives in Malvertising Attacks | SentinelOne

A .NET malware loader distributed via malvertising that uses modified KoiVM-based virtualization, AMSI bypass, VM/sandbox checks, invalid code-signing lures, and the Process Explorer driver for process termination. It stages downstream payloads including Formbook-family malware.

sophos threat researchNews

Nov 13, 2022

‘AuKill’ EDR killer malware abuses Process Explorer driver | SOPHOS

A tool reported by SentinelOne that uses the same vulnerable Process Explorer driver to disable security products before delivery of a final payload.

sophos threat researchNews

Nov 13, 2022

‘AuKill’ EDR killer malware abuses Process Explorer driver | SOPHOS

A tool reported by SentinelOne that uses the same vulnerable Process Explorer driver to disable security products prior to deployment of a final payload.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching20

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

MalVirt

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583Acquire InfrastructureEvidence1

SentinelLABS observed a cluster of virtualized .NET malware loaders distributed through malvertising attacks.

Persistence

1 technique

T1543.003Windows ServiceEvidence1

0onfirm then deploys the driver by creating a service named TaskKill.

Privilege Escalation

2 techniques

T1068Exploitation for Privilege EscalationEvidence2

This technique is commonly referred to as a “bring your own vulnerable driver” (BYOVD) attack.

T1543.003Windows ServiceEvidence1

0onfirm then deploys the driver by creating a service named TaskKill.

Stealth

5 techniques

T1014RootkitEvidence1

T1027Obfuscated Files or InformationEvidence1

some strings (such as amsi.dll and AmsiScanBuffer) are Base-64 encoded and AES-encrypted.

T1497Virtualization/Sandbox EvasionEvidence1

We also observed MalVirt samples evaluating whether they are executing within a virtual machine or an application sandbox environment.

T1497.001System ChecksEvidence1

evaluating the presence of the drivers vboxmouse.sys, vmmouse.sys, and vmhgfs.sys on victim systems.

T1620Reflective Code LoadingEvidence1

When executed, a MalVirt sample reflectively loads an assembly, such as 0onfirm, which further orchestrates the staging of the final payload.

Discovery

3 techniques

T1012Query RegistryEvidence1

detecting the VirtualBox and VMWare environments involves querying the registry keys HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest and HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools

T1497Virtualization/Sandbox EvasionEvidence1

We also observed MalVirt samples evaluating whether they are executing within a virtual machine or an application sandbox environment.

T1497.001System ChecksEvidence1

evaluating the presence of the drivers vboxmouse.sys, vmmouse.sys, and vmhgfs.sys on victim systems.

Impact

1 technique

T1489Service StopEvidence1

Other

2 techniques

T1562.001Disable or Modify ToolsEvidence2

T1562Impair DefensesEvidence1

Over the past several months, Sophos X-Ops has investigated multiple incidents where attackers attempted to disable EDR clients with a new defense evasion tool we’ve dubbed AuKill.

INDICATORS OF COMPROMISE

IOCs tracked for this family

20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

17 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

sentinelone labsNews

Apr 11, 2025

MalVirt | .NET Virtualization Thrives in Malvertising Attacks | SentinelOne

sophos threat researchNews

Nov 13, 2022

‘AuKill’ EDR killer malware abuses Process Explorer driver | SOPHOS

A tool reported by SentinelOne that uses the same vulnerable Process Explorer driver to disable security products before delivery of a final payload.

sophos threat researchNews

Nov 13, 2022

‘AuKill’ EDR killer malware abuses Process Explorer driver | SOPHOS

A tool reported by SentinelOne that uses the same vulnerable Process Explorer driver to disable security products prior to deployment of a final payload.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching20

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.