Skip to content
MalwareWiki

Malware

SPHijacker

According to Trend Micro, this is a tool designed to disable security products, adopting two approaches to achieve this purpose.

SPHijacker is a Windows malware family.

Background

Trend Micro reports that SPHijacker is built to neutralize security software through two distinct methods. The first kills the security product's process by abusing a vulnerable Zemana driver, zamguard64.sys (tracked as CVE-2018-5713). The second blocks the product from launching at all using a novel technique the researchers dubbed stack rumbling.

Source: Malpedia (Fraunhofer FKIE).