DLKiller
DLKiller is a BYOVD-based EDR killer/loader associated with DeadLock ransomware activity. ESET observed DeadLock using DLKiller alongside another EDR killer, Susanoo, as well as anti-rootkit tools such as GMER and PC Hunter during intrusions. DLKiller was used as a pre-encryption tool to disable or terminate security products. The malware abuses the vulnerable Baidu Antivirus driver BdApiUtil.sys via CVE-2024-51324 and uses IOCTL 0x800024b4 to achieve kernel-level process termination. Reporting describes it as a BYOVD loader used with DeadLock ransomware for killing EDR or AV processes. ESET assessed with low confidence that DLKiller and the DeadLock encryptor may have been developed by the same author based on code similarities. The available content does not provide specific IOCs beyond the abused driver name, CVE, and IOCTL value.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
DLKiller ... DeadLockランサムウェアで使用されたBYOVDローダー。Baidu AntivirusドライバBdApiUtil.sysの脆弱性(CVE-2024-51324)を悪用し、IOCTL 0x800024b4でカーネルレベルのプロセス終了を実行 | DLKiller マルウェア(攻撃者作成) ... DeadLockランサムウェアで使用されたBYOVDローダー。Baidu AntivirusドライバBdApiUtil.sysの脆弱性(CVE-2024-51324)を悪用し、IOCTL 0x800024b4でカーネルレベルのプロセス終了を実行。
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
ESET researchers have observed DeadLock using two EDR killers, DLKiller (also mentioned as an unnamed loader by Cisco Talos) and Susanoo, and anti-rootkits such as GMER and PC Hunter.
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Privilege Escalation
1 technique
Privilege Escalation
Defense Impairment
1 technique
Defense Impairment
Impact
1 technique
Impact
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
DeadLockランサムウェアで使われたBYOVDローダーで、脆弱なBdApiUtil.sysを悪用してカーネルレベルでセキュリティプロセスを終了させる。
EDR killer used by the DeadLock gang to impair endpoint defenses; possibly developed by the same author as the DeadLock encryptor.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.