Terminator

Terminator 复现 Spyboy 的技术，即通过滥用 zam64.sys 驱动来终止所有 EDR/XDR/AV 进程 Spyboy 曾以 3,000 美元的价格出售 Terminator 软件 了解更多详情 样本来源于 loldrivers 用法 编译好的版本可以在 此处 找到 将驱动 Terminator.sys 放在与可执行文件相同的路径下 以管理员身份运行该程序 保持程序运行，以防止服务重启反恶意软件 技术细节 该驱动包含某种保护机制，仅允许受信任的进程 ID 发送 IOCTL。如果不将你的进程 ID 添加到受信任列表，你每次都会收到'Access...

The vulnerability of the drivers zam64.sys and zam32.sys in the MalwareFox AntiMalware antivirus software allows a hacker to gain increased privileges.

The vulnerability of the zam64.sys and zam32.sys drivers in the MalwareFox AntiMalware software is related to deficiencies in access control. Exploiting this vulnerability can allow a hacker to enhance their privileges...

CVE-2018-5713

In Malwarefox Anti-Malware 2.72.169, the driver file zam64.sys allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0x80002010...

CVE-2018-5714

In Malwarefox Anti-Malware 2.72.169, the driver file zam64.sys allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0x80002054...