{
  "family": "avkiller",
  "sample_count": 1,
  "category": "ransomware",
  "description": "Trojan:Win32/Avkiller represents a highly specific, destructive class of malware or scripts whose sole purpose is to disable, terminate, or uninstall legitimate security software (Antivirus, EDR, Windows Defender) running on a compromised host (`T1562.001`). Attackers deploy Avkiller utilities immediately prior to launching their primary payload (like a Ransomware encryptor) to ensure the attack proceeds without interference.<br><br><b>Understanding Avkiller (Defense Impairment)</b><br>To an end-user, they might notice a brief error message or the Windows Security Center icon turning red. For a SOC analyst, an Avkiller detection is a 'code red' emergency. It means an attacker has achieved administrative privileges (or SYSTEM level) on a host and is actively tearing down the defenses in preparation for a catastrophic impact event.<br><br><b>Execution and Sabotage Mechanics</b><br>Avkiller tools use various methods to neutralize security agents. They may use legitimate administrative commands (like `sc stop WinDefend`) if they have sufficient privileges. More advanced variants use 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, loading an old, signed, but exploitable driver (like a vulnerable anti-cheat engine) to gain kernel-level execution and forcefully terminate EDR processes that are normally protected against standard user-level attacks (`T1562.001`). They also modify registry keys (e.g., `DisableAntiSpyware`) to prevent services from restarting (`T1112`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total removal of endpoint visibility and protection, leading immediately to full system compromise. Host-based IoCs include EDR 'tampering' alerts, sudden cessation of logs from a specific endpoint, the presence of unknown `.sys` files (drivers) being loaded into the system, and registry modifications within the `HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender` hive.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1068",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (The primary function of Avkiller)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation (Often required to kill protected EDR processes via BYOVD)",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1112",
      "name": "Modify Registry (Disabling security services via policy keys)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint IMMEDIATELY; the attacker is likely deploying ransomware the moment the AV is disabled.",
    "If the EDR agent is offline, rely on network-level isolation (e.g., disabling the switch port or VPN session).",
    "Investigate how the attacker gained the Administrative privileges necessary to execute the Avkiller tool.",
    "Review the memory of the affected host to identify what secondary payloads were executed while the defenses were down."
  ],
  "what_to_avoid": [
    "Do not assume a 'Defender disabled' alert is just a configuration error or user mistake if it correlates with other suspicious activity.",
    "Avoid relying solely on the AV agent to report its own death; use external monitoring to detect when endpoints suddenly stop sending logs."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}