Loading malware…
KillAV is a Windows defense-evasion utility used by multiple ransomware and intrusion operators to disable endpoint security controls, especially antivirus and EDR products, prior to later-stage actions such as lateral movement, data theft, and ransomware deployment. It is commonly described as a tool for terminating security-related processes and services, and in many observed intrusions it is paired with vulnerable kernel drivers to implement a Bring Your Own Vulnerable Driver (BYOVD) technique that forcefully kills protected security software.
KillAV has been observed in operations involving REvil, Conti, Hive, Medusa, TargetCompany/Mallox, and in activity attributed to the China-linked espionage actor Jewelbug. In ransomware intrusions, its role is typically preparatory and post-compromise: operators deploy it after obtaining access in order to reduce detection and resistance from defensive tooling. Reporting also associates it with deployment of vulnerable drivers and with AV-killing workflows alongside tools such as PCHunter, GMER, and AbyssWorker.
The malware targets Windows environments and is used primarily for defense evasion rather than persistence or initial compromise. Its repeated appearance across unrelated campaigns indicates it functions as a reusable offensive utility rather than a family tied to a single actor. High-confidence reporting supports its use to terminate antivirus processes and uninstall or disable security software, including through BYOVD-enabled process termination.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In almost all Medusa attacks, KillAV and associated vulnerable drivers are used... to disable security software... Dropping AVKiller and a driver...
3 distinct techniques documented for this family, organized by ATT&CK tactic.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Tool used to disable/kill security software as part of the defensive evasion stage prior to ransomware deployment.
Tool used to deploy (typically) vulnerable drivers to terminate security processes as part of defense evasion in ransomware intrusions.
Tool referenced as used to terminate/disable antivirus processes as part of Medusa-related intrusion activity (BYOVD/defense evasion).
Custom tool/script used with REvil and Conti to disable or uninstall security software before ransomware deployment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.