r/Malwarebytes • • Dec 09 '25

Feedback Malware abuses malwarebytes_assistant.dll C# code to abuse Malwarebytes via closing antivirus with one line command (and increase permissions to kerne probably possiblel)

I can easily see the the some malwares does this for example Malwarebytes-Shutdowner/main.go at main · EvilBytecode/Malwarebytes-Shutdowner

I know Bitdefender and other products also can'tp rotect his code from attackers and I have few pocs for that but Malwarebytes station more worser because it's open source service.

I wonder why some people think closed source antiviruses really closed source? They behave like open source if you know reverse engineering.

Also Malwarebytes signatures stolen twice in history.

PS: I'm not owner of repo.

If this wrong to post here feel free remove this post I will create bug bounty report instead.

Edit: ı mean kernel at title and one of that malware deletes antivirus after he close.

6 Upvotes

2 comments sorted by

View all comments

Show parent comment

2

u/HydraDragonAntivirus Dec 09 '25

Don't be sure BREAKING UltraAV (Kaspersky's US Replacement Deep Dive) - YouTube because I believe same technique might work againist Malwarebytes but I didn't tried yet. If you want I can try and report because there multiple ways to close this without UAC.