Terminator

• Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes
• Spyboy sells the software for prices ranging from $300 for a single bypass to $3,000 for an all-in-one bypass for more detail
• the sample is sourced from loldrivers

usage

• Place the driver Terminator.sys in the same path as the executable

• run the program as an administrator

• keep the program running to prevent the service from restarting the anti-malwares

  

technical details

• The driver contains some protectiion mechanism that only allow trusted Process IDs to send IOCTLs, Without adding your process ID to the trusted list, you will receive an 'Access Denied' message every time. However, this can be easily bypassed by sending an IOCTL with our PID to be added to the trusted list, which will then permit us to control numerous critical IOCTLs