Skip to content

Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes

Notifications You must be signed in to change notification settings

0xMafty/Terminator

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

28 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Buy Me A Coffee

Terminator

  • Reproducing Spyboy technique, which involves terminating all EDR/XDR/AVs processes by abusing the zam64.sys driver
  • Spyboy was selling the Terminator software at a price of $3,000 for more detail
  • the sample is sourced from loldrivers

usage

  • the compiled version can be found HERE

  • Place the driver Terminator.sys in the same path as the executable

  • run the program as an administrator

  • keep the program running to prevent the service from restarting the anti-malwares

    image

technical details

  • The driver contains some protectiion mechanism that only allow trusted Process IDs to send IOCTLs, Without adding your process ID to the trusted list, you will receive an 'Access Denied' message every time. However, this can be easily bypassed by sending an IOCTL with our PID to be added to the trusted list, which will then permit us to control numerous critical IOCTLs

    image

About

Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • C++ 100.0%