Avkiller

Overview

Trojan:Win32/Avkiller represents a highly specific, destructive class of malware or scripts whose sole purpose is to disable, terminate, or uninstall legitimate security software (Antivirus, EDR, Windows Defender) running on a compromised host (`T1562.001`). Attackers deploy Avkiller utilities immediately prior to launching their primary payload (like a Ransomware encryptor) to ensure the attack proceeds without interference.

Understanding Avkiller (Defense Impairment)
To an end-user, they might notice a brief error message or the Windows Security Center icon turning red. For a SOC analyst, an Avkiller detection is a 'code red' emergency. It means an attacker has achieved administrative privileges (or SYSTEM level) on a host and is actively tearing down the defenses in preparation for a catastrophic impact event.

Execution and Sabotage Mechanics
Avkiller tools use various methods to neutralize security agents. They may use legitimate administrative commands (like `sc stop WinDefend`) if they have sufficient privileges. More advanced variants use 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, loading an old, signed, but exploitable driver (like a vulnerable anti-cheat engine) to gain kernel-level execution and forcefully terminate EDR processes that are normally protected against standard user-level attacks (`T1562.001`). They also modify registry keys (e.g., `DisableAntiSpyware`) to prevent services from restarting (`T1112`).

Indicators of Compromise & Impact
The impact is the total removal of endpoint visibility and protection, leading immediately to full system compromise. Host-based IoCs include EDR 'tampering' alerts, sudden cessation of logs from a specific endpoint, the presence of unknown `.sys` files (drivers) being loaded into the system, and registry modifications within the `HKLM\SOFTWARE\Policies\Microsoft\Windows Defender` hive.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_AVKILLER {
    meta:
        description = "Detects Avkiller (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "avkiller" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Avkiller Activity
id: 80751f7145bd9227fa29b6b0371a8fe5
status: experimental
description: Detects generic indicators of the avkiller malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*avkiller*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint IMMEDIATELY; the attacker is likely deploying ransomware the moment the AV is disabled.
2. If the EDR agent is offline, rely on network-level isolation (e.g., disabling the switch port or VPN session).
3. Investigate how the attacker gained the Administrative privileges necessary to execute the Avkiller tool.
4. Review the memory of the affected host to identify what secondary payloads were executed while the defenses were down.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume a 'Defender disabled' alert is just a configuration error or user mistake if it correlates with other suspicious activity.
2. Avoid relying solely on the AV agent to report its own death; use external monitoring to detect when endpoints suddenly stop sending logs.

References & External Analysis

• Search "avkiller" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Whiteclick
• Armadillo
• Goabeny
• Reyptson
• Baserch

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/avkiller.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.