This thing has been in the wild since 2024, so it had a good run.

It looks pretty bespoke, so there are likely other variants.

Also targeting the anti-virus executable is a smart way to hide. I don't think this backdoor was cheap to develop.