Antavmu

Overview

Trojan:Win32/Antavmu is a targeted malware family specifically designed to act as a **Disabler**. Its primary function is to actively hunt, cripple, and terminate endpoint security software (Antivirus, EDR, Windows Defender) prior to the execution of a secondary, highly destructive payload (like a rootkit or ransomware). Antavmu acts as the vanguard of an attack, 'clearing the path' so subsequent malware can operate completely undetected.

Understanding Antavmu
To an end-user, the infection might manifest as a sudden, unexplained red 'X' on their antivirus icon, or a failure to open the Windows Security Center. For a security analyst, an Antavmu alert is an absolute emergency. If the malware successfully executes its routine, the endpoint becomes completely blind and defenseless, and automated remediation tools will fail.

Execution and Impairment Mechanics
Antavmu is typically dropped by an Initial Access Broker trojan (`T1105`). Upon execution (`T1204.002`), it attempts to escalate privileges to `SYSTEM`. Once achieved, it employs multiple, aggressive techniques to blind the endpoint (`T1562.001`). It uses hardcoded lists of known security vendor processes (e.g., `MsMpEng.exe`, `avp.exe`) and forcefully terminates them (`T1489`). It modifies the Windows Registry to disable real-time protection, tamper protection, and cloud-delivered protection. Some advanced variants of Antavmu delete the actual service registry keys (`HKLM\SYSTEM\CurrentControlSet\Services`) of the antivirus products, ensuring they cannot start even after a reboot.

Indicators of Compromise & Impact
The impact is the complete loss of endpoint visibility and protection, almost always followed immediately by a severe secondary compromise. The primary IoC is an avalanche of EDR 'Tamper Protection' alerts, followed by the EDR sensor suddenly dropping offline. System logs (`Event ID 7036`) will show the unexpected termination of multiple security services. Analysts should investigate the endpoint immediately if multiple security-related registry keys are deleted or modified.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_ANTAVMU {
    meta:
        description = "Detects Antavmu (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "antavmu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Antavmu Activity
id: 4d120b40063a6b29ecd7582adf018af6
status: experimental
description: Detects generic indicators of the antavmu malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*antavmu*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly isolate the endpoint from the network; if Antavmu is active, a severe secondary deployment (like ransomware) is likely imminent.
2. Do not rely on the local EDR agent for containment if Antavmu was successful; isolate the machine at the switch/firewall level.
3. Capture a memory dump (RAM) immediately. The disabler module and the subsequent payload are likely active in memory even if the EDR is blind.
4. Perform a deep forensic review to identify the initial entry vector that allowed Antavmu to gain execution privileges.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do NOT assume the endpoint is safe if you simply restart the antivirus service; the malware maintains persistence and will disable it again.
2. Avoid relying solely on automated remediation; a successful Antavmu attack means the automated tools have been compromised.

References & External Analysis

• Search "antavmu" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Uwamson
• Xxycff
• Piker
• Msidrop
• Yolov

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/antavmu.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.