Antivirus

Avast security tools hijacked in order to crack antivirus protection

Researchers spot new campaign that can turn off antivirus protection Malware uses legitimate Avast Anti-Rootkit driver to access kernel level Once antivirus is deactivated, the malware can proceed without detection Hackers are using a legitimate Avast Anti-Rootkit driver to disguise their malware, turn off antivirus protection, and infect systems, experts have warned. The vulnerable driver


  • Researchers spot new campaign that can turn off antivirus protection
  • Malware uses legitimate Avast Anti-Rootkit driver to access kernel level
  • Once antivirus is deactivated, the malware can proceed without detection

Hackers are using a legitimate Avast Anti-Rootkit driver to disguise their malware, turn off antivirus protection, and infect systems, experts have warned.

The vulnerable driver has been exploited in a number of attacks since 2021, with the original vulnerabilities being present since at least 2016, research by Trellix, has claimed, noting the malware can use the vulnerable driver to end the processes of security software at the kernel level.

The malware in question belongs to the AV Killer family, with the attack using a vector known as bring-your-own-vulnerable-driver (BYOVD) to infect the system.

Virus can turn off antivirus

Trellix outlined how the malware uses a file named ‘kill-floor.exe’ to place the vulnerable driver named ‘ntfs.bin’ into the default Windows user folder, before using the Service Control executable (sc.exe) to register the driver using the ‘aswArPot.sys’ service.

Included within the malware is a hardcoded list of 142 processes used by common security products, which is used to check system process snapshots for any matches.

The malware then uses the ‘DeviceIoControl’ API to run the relevant commands to end the process, thereby preventing the antivirus from detecting the malware.

The hardcoded list includes processes belonging to a number of security products from names such as McAfee, Avast, Microsoft Defender, BlackBerry, Sophos, and many more.

As BleepingComputer points out, this isn’t the first time a BYOVD attack has exploited a vulnerable Avast driver, with the 2021 Avoslocker ransomware attacks abusing an Avast Anti-R

Read More

Be the first to write a comment.

Leave a Reply

Your email address will not be published. Required fields are marked *

Antivirus

Don’t fall for McAfee’s tricky antivirus warnings on your laptop

I review a lot of laptops and I’ve noticed many of them come with a “free trial” of McAfee antivirus preinstalled. I’ve clicked through so many warnings about how my PC will be “at risk” unless I pay up for extended protection, and those McAfee alerts are in a stark red color that’s surely designed

I review a lot of laptops and I’ve noticed many of them come with a “free trial” of McAfee antivirus preinstalled. I’ve clicked through so many warnings about how my PC will be “at risk” unless I pay up for extended protection, and those McAfee alerts are in a stark red color that’s surely designed to scare me…
Read More

Continue Reading
Antivirus

This antivirus actually respects your Mac

Macworld Mac users, we get it—you don’t like bloated, ugly antivirus software slowing down your beautifully tuned machines. But you also don’t want to be the one person who ignores modern cyber threats just because “Macs don’t get viruses.” Spoiler: they can and they do. If you’re looking for a lightweight…

Macworld

Mac users, we get it—you don’t like bloated, ugly antivirus software slowing down your beautifully tuned machines. But you also don’t want to be the one person who ignores modern cyber threats just because “Macs don’t get viruses.” Spoiler: they can and they do.

If you’re looking for a lightweight…
Read More

Continue Reading
Antivirus

I tested the best antivirus software for Windows: Here’s what I’d use to protect my PC

ZDNET tested the best antivirus software on the market that supports multiple operating systems, VPNS, and robust protection…

ZDNET tested the best antivirus software on the market that supports multiple operating systems, VPNS, and robust protection…
Read More

Continue Reading
Antivirus

Your antivirus is under attack from new “killer” tool – here’s what we know

EDRKillShifter is getting a dangerous upgrade The new malware can disable AV and EDR from reputable vendors Sophos, Bitdefender, and Kaspersky among the tools being targeted Cybercriminals appear to have improved their antivirus-killing capabilities, as recent research suggest a new tool being shared within the underground community. In a new report, security researchers from Sophos


  • EDRKillShifter is getting a dangerous upgrade
  • The new malware can disable AV and EDR from reputable vendors
  • Sophos, Bitdefender, and Kaspersky among the tools being targeted

Cybercriminals appear to have improved their antivirus-killing capabilities, as recent research suggest a new tool being shared within the underground community.

In a new report, security researchers from Sophos said multiple ransomware groups are successfully disabling endpoint detection and response (EDR) systems before deploying the encryptor.

Originally, the group known as RansomHub developed a tool called EDRKillShifter, which Sophos says is now made obsolete thanks to this new and improved variant. The new tool can disable security software from multiple high-end vendors such as Sophos, Bitdefender, and Kaspersky.

You may like

  • ransomware avast This devious ransomware is able to hijack your system to turn off antivirus
  • A robot hand touching a locked digital shield blocking a human from accessing data Hackers can turn off Windows Defender with this sneaky new tool
  • A digital representation of a lock This top security platform is being hacked to carry out malware threats

Shifting strategies

The malware is often packed using a service called HeartCrypt, which obfuscates the code to evade detection.

Sophos found the attackers are using all sorts of obfuscation and anti-analysis techniques to protect their tools from security defenders, and in some cases, they’re even using signed drivers (either stolen or compromised).

In one case, the malicious code was embedded inside a legitimate utility, Beyond Compare’s Clipboard Compare tool, the researchers explained.

Sophos also said that multiple ransomware groups are using this new EDR-killing tool, suggesting a high level of collaboration between players.

EDRKillShifter was first spotted in mid-2024, after a failed attempt to disable an antivirus and deploy ransomware.

Sophos then uncovered that the malware dropped a legitimate, but vulnerable driver.

Now, it seems there is a new method – taking an already legitimate executable and modifying it locally by inserting malicious code and payload resources (as was the case with Beyond Compare’s tool). This is often done after the attacker has access to a

Read More

Continue Reading