Procedure examples

A module in Prikormka collects information from the victim about installed anti-virus software.

PUBLOAD has identified AV products on an infected host using the following command: `WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List`.

Woody RAT can detect Avast Software, Doctor Web, Kaspersky, AVG, ESET, and Sophos antivirus programs.

Mafalda can search for a variety of security software programs, EDR systems, and malware analysis tools.

AuTo Stealer has the ability to collect information about installed AV products from an infected host.

FlawedAmmyy will attempt to detect anti-virus products during the initial infection.

InvisiMole can check for the presence of network sniffers, AV, and BitDefender firewall.

WhisperGate can recognize the presence of monitoring tools on a target system.

Skidmap has the ability to check if /usr/sbin/setenforce exists. This file controls what mode SELinux is in.

Raspberry Robin attempts to identify security software running on the victim machine, such as BitDefender, Avast, and Kaspersky.

Mispadu can list installed security products in the victim’s environment.

RustyWater has attempted to detect more than 25 antivirus and EDR tools.

IcedID can identify AV products on an infected host using the following command:
` WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List`.

VERMIN uses WMI to check for anti-virus software installed on the system.

MarkiRAT can check for running processes on the victim’s machine to look for Kaspersky and Bitdefender antivirus products.

CHIMNEYSWEEP is capable of checking whether a compromised device is running DeepFreeze by Faronics.

NotPetya determines if specific antivirus programs are running on an infected host machine.

SpicyOmelette can check for the presence of 29 different antivirus tools.

PUNCHBUGGY can gather AVs registered in the system.

DarkTortilla can check for the Kaspersky Anti-Virus suite.

Exbyte checks for the presence of various security software products during execution.

DarkWatchman can search for anti-virus products on the system.

Lumma Stealer has detected antivirus processes using commands such as “tasklist” and “findstr.”

DustySky checks for the existence of anti-virus.

Remsec has a plugin detect security products via active drivers.

Epic searches for anti-malware services running on the victim’s machine and terminates itself if it finds them.

PureCrypter can identify installed antivirus solutions.

DarkGate looks for various security products by process name using hard-coded values in the malware. DarkGate will not execute its keylogging thread if a process name associated with Trend Micro anti-virus is identified, or if runtime checks identify the presence of Kaspersky anti-virus. DarkGate will initiate a new thread if certain security products are identified on the victim, and recreate any malicious files associated with it if it determines they were removed by security software in a new system location.

ThiefQuest uses the kill_unwanted function to get a list of running processes, compares each process with an encrypted list of “unwanted” security related programs, and kills the processes for security related programs.

Ferocious has checked for AV software as part of its persistence process.

Netwalker can detect and terminate active security software-related processes on infected systems.

Latrodectus has the ability to identify installed antivirus products.

MuddyViper has the ability to check for a specified list of security tools in the compromised environment.

EVILNUM can search for anti-virus products on the system.

Metamorfo collects a list of installed antivirus software from the victim’s system.

PipeMon can check for the presence of ESET and Kaspersky security software.

T9000 performs checks for various antivirus and security products during installation.

MoleNet can use WMI commands to check the system for firewall and antivirus software.

BLUELIGHT can collect a list of anti-virus products installed on a machine.

down_new has the ability to detect anti-virus products and processes on a compromised host.

Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.

RedLine Stealer has identified installed antivirus software on the system.

StoneDrill can check for antivirus and antimalware programs.

RogueRobin enumerates running processes to search for Wireshark and Windows Sysinternals suite.

LitePower can identify installed AV software.

StreamEx has the ability to scan for security tools such as firewalls and antivirus tools.

Mosquito's installer searches the Registry and system to see if specific antivirus tools are installed on the system.

RTM can obtain information about security software on the victim.

BlackByte Ransomware looks for security software products prior to full execution.

Grandoreiro can list installed security products including the Trusteer and Diebold Warsaw GAS Tecnologia online banking protections.