AVKiller
AVKiller is an antivirus termination utility observed as a payload in malware campaigns and during ongoing ransomware attacks. The provided reporting describes it as a lesser-prevalent antivirus-killing program and notes shared AVKiller utilities used alongside newer malware variants that leverage vulnerable kernel drivers to evade endpoint defenses. Sophos observed HeartCrypt-packed AVKiller payloads in ransomware incidents involving RansomHub and MedusaLocker. In those cases, one AV killer sample was VMProtect-packed and targeted security products from ESET, HitmanPro, Kaspersky, Sophos, and Symantec. High-confidence context links AVKiller to ransomware operations and to delivery via the HeartCrypt packer-as-a-service ecosystem, which has been distributed through phishing emails, DLL sideloading, LNK/PowerShell downloaders, and password-protected archives hosted on cloud services. The content does not provide standalone AVKiller-specific indicators of compromise beyond its role as an AV-disabling payload and the named targeted security products.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...researchers observing shared ‘AVKiller’ utilities and newer malware variants leveraging vulnerable kernel drivers to evade endpoint defenses.
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
IOCs tracked for this family
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Utility/tooling used to disable or evade security controls (e.g., AV/EDR), including via vulnerable kernel driver abuse (BYOVD) as part of ransomware intrusion tradecraft.
Malware designed to terminate antivirus processes, often used as part of multi-stage attacks to disable security defenses.
A security-tool disabling payload delivered by HeartCrypt, often VMProtect-packed, used to target and disable endpoint protection products and observed during active ransomware intrusions.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.