{
  "family": "antavmu",
  "sample_count": 9,
  "category": "ransomware",
  "description": "Trojan:Win32/Antavmu is a targeted malware family specifically designed to act as a **Disabler**. Its primary function is to actively hunt, cripple, and terminate endpoint security software (Antivirus, EDR, Windows Defender) prior to the execution of a secondary, highly destructive payload (like a rootkit or ransomware). Antavmu acts as the vanguard of an attack, 'clearing the path' so subsequent malware can operate completely undetected.<br><br><b>Understanding Antavmu</b><br>To an end-user, the infection might manifest as a sudden, unexplained red 'X' on their antivirus icon, or a failure to open the Windows Security Center. For a security analyst, an Antavmu alert is an absolute emergency. If the malware successfully executes its routine, the endpoint becomes completely blind and defenseless, and automated remediation tools will fail.<br><br><b>Execution and Impairment Mechanics</b><br>Antavmu is typically dropped by an Initial Access Broker trojan (`T1105`). Upon execution (`T1204.002`), it attempts to escalate privileges to `SYSTEM`. Once achieved, it employs multiple, aggressive techniques to blind the endpoint (`T1562.001`). It uses hardcoded lists of known security vendor processes (e.g., `MsMpEng.exe`, `avp.exe`) and forcefully terminates them (`T1489`). It modifies the Windows Registry to disable real-time protection, tamper protection, and cloud-delivered protection. Some advanced variants of Antavmu delete the actual service registry keys (`HKLM\\SYSTEM\\CurrentControlSet\\Services`) of the antivirus products, ensuring they cannot start even after a reboot.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the complete loss of endpoint visibility and protection, almost always followed immediately by a severe secondary compromise. The primary IoC is an avalanche of EDR 'Tamper Protection' alerts, followed by the EDR sensor suddenly dropping offline. System logs (`Event ID 7036`) will show the unexpected termination of multiple security services. Analysts should investigate the endpoint immediately if multiple security-related registry keys are deleted or modified.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1489",
    "T1112",
    "T1105",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Terminating AV/EDR)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1112",
      "name": "Modify Registry (Disabling Defender settings and deleting AV services)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1489",
      "name": "Service Stop (Forcefully stopping AV services)",
      "tactic": "Impact"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Downloading the secondary payload after blinding)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network; if Antavmu is active, a severe secondary deployment (like ransomware) is likely imminent.",
    "Do not rely on the local EDR agent for containment if Antavmu was successful; isolate the machine at the switch/firewall level.",
    "Capture a memory dump (RAM) immediately. The disabler module and the subsequent payload are likely active in memory even if the EDR is blind.",
    "Perform a deep forensic review to identify the initial entry vector that allowed Antavmu to gain execution privileges."
  ],
  "what_to_avoid": [
    "Do NOT assume the endpoint is safe if you simply restart the antivirus service; the malware maintains persistence and will disable it again.",
    "Avoid relying solely on automated remediation; a successful Antavmu attack means the automated tools have been compromised."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}