Loading malware…
DLKiller is a BYOVD-based EDR killer/loader associated with DeadLock ransomware activity. ESET observed DeadLock using DLKiller alongside another EDR killer, Susanoo, as well as anti-rootkit tools such as GMER and PC Hunter during intrusions. DLKiller was used as a pre-encryption tool to disable or terminate security products. The malware abuses the vulnerable Baidu Antivirus driver BdApiUtil.sys via CVE-2024-51324 and uses IOCTL 0x800024b4 to achieve kernel-level process termination. Reporting describes it as a BYOVD loader used with DeadLock ransomware for killing EDR or AV processes. ESET assessed with low confidence that DLKiller and the DeadLock encryptor may have been developed by the same author based on code similarities. The available content does not provide specific IOCs beyond the abused driver name, CVE, and IOCTL value.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
DLKiller ... DeadLockランサムウェアで使用されたBYOVDローダー。Baidu AntivirusドライバBdApiUtil.sysの脆弱性(CVE-2024-51324)を悪用し、IOCTL 0x800024b4でカーネルレベルのプロセス終了を実行 | DLKiller マルウェア(攻撃者作成) ... DeadLockランサムウェアで使用されたBYOVDローダー。Baidu AntivirusドライバBdApiUtil.sysの脆弱性(CVE-2024-51324)を悪用し、IOCTL 0x800024b4でカーネルレベルのプロセス終了を実行。
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
ESET researchers have observed DeadLock using two EDR killers, DLKiller (also mentioned as an unnamed loader by Cisco Talos) and Susanoo, and anti-rootkits such as GMER and PC Hunter.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
DeadLockランサムウェアで使われたBYOVDローダーで、脆弱なBdApiUtil.sysを悪用してカーネルレベルでセキュリティプロセスを終了させる。
EDR killer used by the DeadLock gang to impair endpoint defenses; possibly developed by the same author as the DeadLock encryptor.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.