Procedure examples

Bumblebee can identify specific analytical tools based on running processes.

Amadey has checked for a variety of antivirus products.

Stuxnet enumerates the currently running processes related to a variety of security products.

POWRUNER may collect information on the victim's anti-virus software.

TAMECAT has used Windows Management Instrumentation (WMI) to check for anti-virus products.

Felismus checks for processes associated with anti-virus vendors.

Zeus Panda checks to see if anti-virus, anti-spyware, or firewall products are installed in the victim’s environment.

StrongPity can identify if ESET or BitDefender antivirus are installed before dropping its payload.

xCaon has checked for the existence of Kaspersky antivirus software on the system.

ROAMINGHOUSE can identify McAfee applications on compromised hosts and change its execution method if one is detected.

TONESHELL has checked for the presence of ESET antivirus applications `ekrn.exe` and `egui.exe`.

Kasidet has the ability to identify any anti-virus installed on the infected system.

Medusa Ransomware has the capability to detect security solutions for termination or deletion within the victim device using hard-coded lists of strings containing security product executables.

Crimson contains a command to collect information about anti-virus software on the victim.

DUSTTRAP can identify security software.

Action RAT can identify AV products on an infected host using the following command: `cmd.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List`.

Avenger has the ability to identify installed anti-virus products on a compromised host.

A module in Prikormka collects information from the victim about installed anti-virus software.

PUBLOAD has identified AV products on an infected host using the following command: `WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List`.

Woody RAT can detect Avast Software, Doctor Web, Kaspersky, AVG, ESET, and Sophos antivirus programs.

Mafalda can search for a variety of security software programs, EDR systems, and malware analysis tools.

AuTo Stealer has the ability to collect information about installed AV products from an infected host.

FlawedAmmyy will attempt to detect anti-virus products during the initial infection.

InvisiMole can check for the presence of network sniffers, AV, and BitDefender firewall.

WhisperGate can recognize the presence of monitoring tools on a target system.

Skidmap has the ability to check if /usr/sbin/setenforce exists. This file controls what mode SELinux is in.

Raspberry Robin attempts to identify security software running on the victim machine, such as BitDefender, Avast, and Kaspersky.

Mispadu can list installed security products in the victim’s environment.

RustyWater has attempted to detect more than 25 antivirus and EDR tools.

IcedID can identify AV products on an infected host using the following command:
` WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List`.

VERMIN uses WMI to check for anti-virus software installed on the system.

MarkiRAT can check for running processes on the victim’s machine to look for Kaspersky and Bitdefender antivirus products.

CHIMNEYSWEEP is capable of checking whether a compromised device is running DeepFreeze by Faronics.

NotPetya determines if specific antivirus programs are running on an infected host machine.

SpicyOmelette can check for the presence of 29 different antivirus tools.

PUNCHBUGGY can gather AVs registered in the system.

DarkTortilla can check for the Kaspersky Anti-Virus suite.

Exbyte checks for the presence of various security software products during execution.

DarkWatchman can search for anti-virus products on the system.

Lumma Stealer has detected antivirus processes using commands such as “tasklist” and “findstr.”

DustySky checks for the existence of anti-virus.

Remsec has a plugin detect security products via active drivers.

Epic searches for anti-malware services running on the victim’s machine and terminates itself if it finds them.

PureCrypter can identify installed antivirus solutions.

DarkGate looks for various security products by process name using hard-coded values in the malware. DarkGate will not execute its keylogging thread if a process name associated with Trend Micro anti-virus is identified, or if runtime checks identify the presence of Kaspersky anti-virus. DarkGate will initiate a new thread if certain security products are identified on the victim, and recreate any malicious files associated with it if it determines they were removed by security software in a new system location.

ThiefQuest uses the kill_unwanted function to get a list of running processes, compares each process with an encrypted list of “unwanted” security related programs, and kills the processes for security related programs.

Ferocious has checked for AV software as part of its persistence process.

Netwalker can detect and terminate active security software-related processes on infected systems.

Latrodectus has the ability to identify installed antivirus products.

MuddyViper has the ability to check for a specified list of security tools in the compromised environment.