Using Memory Analysis to Detect EDR-Nullifying Malware
Summary: Volexity analyzed a tool called AVBurner, attributed to the Chinese APT it tracks as SnakeCharmer (Trend Micro's "Earth Longzhi"), which patches process-creation callbacks in kernel memory so EDR and AV software keeps running but is rendered useless. The malware uses a vulnerable driver, RTCore64.sys, to write into protected kernel memory, and the analyzed sample targeted drivers with "360" in their metadata, indicating it was built against Qihoo 360 products.
Why it matters: A security product that reports itself as healthy while its callbacks have been zeroed out means your dashboard can show green during an active intrusion - Volexity's own example found 13 expected callbacks but only 11 still registered.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026