Crypto24 Custom EDR Bypass Tool
Detects the execution of a custom EDR bypass tool (AVB.exe or AVMon.exe) used by the Crypto24 ransomware group. This tool is a variant of RealBlindingEDR and is used to disable security products.
YARA-L
Detects the execution of a custom EDR bypass tool (AVB.exe or AVMon.exe) used by the Crypto24 ransomware group. This tool is a variant of RealBlindingEDR and is used to disable security products.
Already have an account?