EDR Killers Explained: Beyond the Drivers

    Friday, March 20, 2026 In: Threat Research Print

    Date: 03/20/2026

    Severity: High

    Summary

    EDR killers have become a standard component of modern ransomware attacks, used by affiliates to disable security tools before deploying encryption payloads. While the BYOVD technique remains common, attackers increasingly adopt driverless methods, legitimate utilities, and customizable kits to evade detection. Analysis of real-world activity shows that these tools are widely shared, reused, and commercially available, making attribution difficult. Their predictable role in the attack chain highlights their importance in enabling successful ransomware operations and the growing need for behavior-based defenses.

    Indicators of Compromise (IOC) List

    Hash

    6bc8e3505d9f51368ddf323acb6abc49

    427bf30a292c0fb874ccf43621c321d7

    5fea22f442e7fd34a54008e363446d13

    d5b6a6a6e49d8b4ad03399347f8b7c4f

    761f2e2b759389a472bd3d94141742b9

    a179c4093d05a3e1ee73f6ff07f994aa

    f9580d01f9ea52ebc4f936f0b965bc1d

    fdfb047b7bfe8ab75bf3b14ff90134e1

    ced47b89212f3260ebeb41682a4b95ec

    9b04a93e05ccff94667f04bffa7af600

    b96d75a000367c200958089728fc5cb8

    3fd73115a166157e731e8b538155ab4f

    f0ac3999d4020cd051052a0627a2056d

    2445ad5af37e4b377c75c99ae0134fd8

    03af2bf85923ce0fda7c20f8f82839c9

    206ec9a4c5c762f0616892d5ebd1075a

    8c8c93a6b6c6d6e632a54877fc1a209e

    54de95cc33834a2f877ba4842860af27

    8799d3a982908efa3fce789ca232bbe8

    a2b2cacd5ab0e553d9b3d359564014dc

    df68efa65a6daeb09ccaf0c0d3f1f3de

    a6bcb7f952361c843134b81997c8d3c5

    9e82ee5bde6b5d29281a3c280e6d1f2e

    959a879773754f8a8c437e2e7df944fd

    68355b3f882a0deda8f81f1693cae4c3

    cf7cad39407d8cd93135be42b6bd258f

    fa8fa492cff3bbb1116e6b78b98642f6

    0f5b41e746b09c740e57c0262edbd140

    054a32d6033b1744dca7f49b2e466ea2

    83ea5f14c017edd0420035505ccf2898

    209d3ad105126b68d6235d77d2b36e63

    1cdeb632f052e3f36d125d2318e5c70c

    82ed942a52cdcf120a8919730e00ba37619661a3

    bc65ed919988c8e4b8f5a1cd371745456601700a

    67d17ca90880b448d5c3b40f69cec04d3649f170

    a9f37104d2d89051f34e1486bc6ebff44d147e67

    c881f43c7fe94a6f056a84da8e9a32fe56d8dd9c

    5d6b9e80e12bfc595d4d26f6afb099b3cb471dd4

    083f604377d74c4377822ef35021e34ad7daceea

    34270b07538b7357cf10d0d5bda68f234b602f93

    148c0cde4f2ef807aea77d7368f00f4c519f47ef

    468121e7d6952799f92940677268937c4c5f92ed

    f329ae0fdf1e198bea6ba787e59cb73f90714002

    a3bdb419703a70157f2b7bd1dc2e4c9227dd9fe8

    ba14c43031411240a0836bedf8c8692b54698e05

    31ce76931ca09d3918b34e3187703bc72e6d647e

    54547180a99474b0dba289d92c4a8f3eea78b531

    4a57083122710d51f247367afd813a740ac180a1

    7310d6399683ba3eb2f695a2071e0e45891d743b

    127b50c8185986a52ae66bf6e7e67a6fd787c4fc

    65c2388b0afb1d1f1860bb887456d8d6cd8b5645

    db8bcb8693ddf715552f85b8e2628f060070f920

    711c95fead2215e9ac59e32e6e3b0d71ad5c5aa5

    002573d80091f7f8167bcbda3a402b85fa915f19

    75f85caea52fe5a124fa77e2934abd3161690add

    bbe0e14bc7ece8a7a1236d5a12e30476cfcef110

    09735640d6634b0303755a9fd3b2bc80f932126c

    ce1b9909cef820e5281618a7a0099a27a70643dc

    85bc0a4f67522d6ac6be64d763e65a2945ec5028

    6ee94f6bdc4c4ed0fff621fec36c70ff093659ed

    c85c9a09cd1cb1691da0d96772391be6ddba3555

    1e7567c0d525ad037fbbbafb643bf40541994411

    b9820bf443c375577ceef44b9491e3a569a1b9e8

    570161a420992280a8eced253edc800296b72d1c

    16f83f056177c4ec24c7e99d01ca9d9d6713bd0497eeedb777a3ffefa99c97f0

    b0f201128e80b5b79dac41da52691cb5803fb1ae3e9272eb252ece4a5d887485

    9165d4f3036919a96b86d24b64d75d692802c7513f2b3054b20be40c212240a5

    2d89fb7455ff3ebf6b965d8b1113857607f7fbda4c752ccb591dbc1dc14ba0da

    1c1a4ca2cbac9fe5954763a20aeb82da9b10d028824f42fff071503dcbe15856

    4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1

    e75d06b1461b971335076c4839483ea14010e837959595dbb4fe2e1fd0fd85a8

    d407c66a31e353b4bb588df28c38e772c2163d18d397f0da09068eed7d415e4d

    47ec51b5f0ede1e70bd66f3f0152f9eb536d534565dbb7fcc3a05f542dbe4428

    b16e217cdca19e00c1b68bdfb28ead53b20adeabd6edcd91542f9fbf48942877

    6e8b49cf70bf854e8c59c7d27cefa89406caf8978461190dabb86dafcd8554e1

    5b7b280b53ff3cf95ead4fd4a435cd28294c5fce6a924ec52e500a109deb868b

    0d2619844a3ab68ee18c3a4768b10e6b8aea31143023277883b7ff9f7a9e55ca

    eb4c27e5835238bb3ac5b48f0b17794c0be981cb489f8c61e326f26a51d5cbf1

    df6cb5199c272c491b3a7ac44df6c4c279d23f7c09daed758c831b26732a4851

    41e2b2faf0d149961b919e9f31e8eae7d5ee2bdabd5f69ac7dd6017a6b8433e8

    023d722cbbdd04e3db77de7e6e3cfeabcef21ba5b2f04c3f3a33691801dd45eb

    95a6f6e79c1842cea3603df3209fddc12aeb4fc77d1c58a852f877b1eaa9c4c9

    d0f9eae1776a98c77a6c6d66a3fd32cee7ee6148a7276bc899c1a1376865d9b0

    017933be6023795e944a2a373e74e2cc6885b5c9bc1554c437036250c20c3a7d

    998ad94a1f56e2dcd4a643979ac7c2335974a6eb69b7c19947808ef7d39488a9

    bb0aff8835f64368fabea1add6fcb10be6ee30eb316811561dc2f9acd6a2665d

    b7703a59c39a0d2f7ef6422945aaeaaf061431af0533557246397551b8eed505

    680b8005db5338b5405687fe7dd0ad4dbf1c0fc3f4705930e94416bfa540304d

    2ff41829aba4523e724c4b8b599fcbed15296bc80db610f849dd4c58c611d38a

    bd1f381e5a3db22e88776b7873d4d2835e9a1ec620571d2b1da0c58f81c84a56

    b966f5db38edc5aa56d7a1fb2eb79025d27f42997a99950b23f7adfa620f3290

    7e783b0a0ff4710306bb3bca29296cf962ae77abc81245a99f12a9039158226f

    ea8c8f834523886b07d87e85e24f124391d69a738814a0f7c31132b6b712ed65

    7578ce5cbb80036c09b0e34b02b4f4f4e0172d1f7e428c9ea60d3c738e437842

    fd820c2509bd8a4522d0e0dd7130cce72dff10410942f52b49f693a2caec68a4

    8d53d875d634a0102c55b620b501fe9b774e50cec8dbce2f097d08ff95ae256e

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    md5hash IN ("f0ac3999d4020cd051052a0627a2056d","6bc8e3505d9f51368ddf323acb6abc49","cf7cad39407d8cd93135be42b6bd258f","427bf30a292c0fb874ccf43621c321d7","a179c4093d05a3e1ee73f6ff07f994aa","03af2bf85923ce0fda7c20f8f82839c9","a2b2cacd5ab0e553d9b3d359564014dc","fa8fa492cff3bbb1116e6b78b98642f6","3fd73115a166157e731e8b538155ab4f","959a879773754f8a8c437e2e7df944fd","0f5b41e746b09c740e57c0262edbd140","54de95cc33834a2f877ba4842860af27","b96d75a000367c200958089728fc5cb8","9b04a93e05ccff94667f04bffa7af600","f9580d01f9ea52ebc4f936f0b965bc1d","054a32d6033b1744dca7f49b2e466ea2","8c8c93a6b6c6d6e632a54877fc1a209e","5fea22f442e7fd34a54008e363446d13","d5b6a6a6e49d8b4ad03399347f8b7c4f","9e82ee5bde6b5d29281a3c280e6d1f2e","ced47b89212f3260ebeb41682a4b95ec","761f2e2b759389a472bd3d94141742b9","fdfb047b7bfe8ab75bf3b14ff90134e1","2445ad5af37e4b377c75c99ae0134fd8","206ec9a4c5c762f0616892d5ebd1075a","8799d3a982908efa3fce789ca232bbe8","df68efa65a6daeb09ccaf0c0d3f1f3de","a6bcb7f952361c843134b81997c8d3c5","68355b3f882a0deda8f81f1693cae4c3","83ea5f14c017edd0420035505ccf2898","209d3ad105126b68d6235d77d2b36e63","1cdeb632f052e3f36d125d2318e5c70c")

    Detection Query 2 :

    sha1hash IN ("54547180a99474b0dba289d92c4a8f3eea78b531","c85c9a09cd1cb1691da0d96772391be6ddba3555","127b50c8185986a52ae66bf6e7e67a6fd787c4fc","67d17ca90880b448d5c3b40f69cec04d3649f170","75f85caea52fe5a124fa77e2934abd3161690add","82ed942a52cdcf120a8919730e00ba37619661a3","c881f43c7fe94a6f056a84da8e9a32fe56d8dd9c","5d6b9e80e12bfc595d4d26f6afb099b3cb471dd4","083f604377d74c4377822ef35021e34ad7daceea","bbe0e14bc7ece8a7a1236d5a12e30476cfcef110","bc65ed919988c8e4b8f5a1cd371745456601700a","ba14c43031411240a0836bedf8c8692b54698e05","85bc0a4f67522d6ac6be64d763e65a2945ec5028","f329ae0fdf1e198bea6ba787e59cb73f90714002","148c0cde4f2ef807aea77d7368f00f4c519f47ef","a9f37104d2d89051f34e1486bc6ebff44d147e67","7310d6399683ba3eb2f695a2071e0e45891d743b","a3bdb419703a70157f2b7bd1dc2e4c9227dd9fe8","db8bcb8693ddf715552f85b8e2628f060070f920","ce1b9909cef820e5281618a7a0099a27a70643dc","6ee94f6bdc4c4ed0fff621fec36c70ff093659ed","468121e7d6952799f92940677268937c4c5f92ed","34270b07538b7357cf10d0d5bda68f234b602f93","31ce76931ca09d3918b34e3187703bc72e6d647e","4a57083122710d51f247367afd813a740ac180a1","65c2388b0afb1d1f1860bb887456d8d6cd8b5645","711c95fead2215e9ac59e32e6e3b0d71ad5c5aa5","002573d80091f7f8167bcbda3a402b85fa915f19","09735640d6634b0303755a9fd3b2bc80f932126c","1e7567c0d525ad037fbbbafb643bf40541994411","b9820bf443c375577ceef44b9491e3a569a1b9e8","570161a420992280a8eced253edc800296b72d1c")

    Detection Query 3 :

    sha256hash IN ("9165d4f3036919a96b86d24b64d75d692802c7513f2b3054b20be40c212240a5","1c1a4ca2cbac9fe5954763a20aeb82da9b10d028824f42fff071503dcbe15856","95a6f6e79c1842cea3603df3209fddc12aeb4fc77d1c58a852f877b1eaa9c4c9","680b8005db5338b5405687fe7dd0ad4dbf1c0fc3f4705930e94416bfa540304d","16f83f056177c4ec24c7e99d01ca9d9d6713bd0497eeedb777a3ffefa99c97f0","2d89fb7455ff3ebf6b965d8b1113857607f7fbda4c752ccb591dbc1dc14ba0da","4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1","5b7b280b53ff3cf95ead4fd4a435cd28294c5fce6a924ec52e500a109deb868b","b16e217cdca19e00c1b68bdfb28ead53b20adeabd6edcd91542f9fbf48942877","b0f201128e80b5b79dac41da52691cb5803fb1ae3e9272eb252ece4a5d887485","47ec51b5f0ede1e70bd66f3f0152f9eb536d534565dbb7fcc3a05f542dbe4428","6e8b49cf70bf854e8c59c7d27cefa89406caf8978461190dabb86dafcd8554e1","b7703a59c39a0d2f7ef6422945aaeaaf061431af0533557246397551b8eed505","7e783b0a0ff4710306bb3bca29296cf962ae77abc81245a99f12a9039158226f","e75d06b1461b971335076c4839483ea14010e837959595dbb4fe2e1fd0fd85a8","0d2619844a3ab68ee18c3a4768b10e6b8aea31143023277883b7ff9f7a9e55ca","bd1f381e5a3db22e88776b7873d4d2835e9a1ec620571d2b1da0c58f81c84a56","b966f5db38edc5aa56d7a1fb2eb79025d27f42997a99950b23f7adfa620f3290","017933be6023795e944a2a373e74e2cc6885b5c9bc1554c437036250c20c3a7d","ea8c8f834523886b07d87e85e24f124391d69a738814a0f7c31132b6b712ed65","023d722cbbdd04e3db77de7e6e3cfeabcef21ba5b2f04c3f3a33691801dd45eb","df6cb5199c272c491b3a7ac44df6c4c279d23f7c09daed758c831b26732a4851","d407c66a31e353b4bb588df28c38e772c2163d18d397f0da09068eed7d415e4d","eb4c27e5835238bb3ac5b48f0b17794c0be981cb489f8c61e326f26a51d5cbf1","41e2b2faf0d149961b919e9f31e8eae7d5ee2bdabd5f69ac7dd6017a6b8433e8","d0f9eae1776a98c77a6c6d66a3fd32cee7ee6148a7276bc899c1a1376865d9b0","998ad94a1f56e2dcd4a643979ac7c2335974a6eb69b7c19947808ef7d39488a9","bb0aff8835f64368fabea1add6fcb10be6ee30eb316811561dc2f9acd6a2665d","2ff41829aba4523e724c4b8b599fcbed15296bc80db610f849dd4c58c611d38a","7578ce5cbb80036c09b0e34b02b4f4f4e0172d1f7e428c9ea60d3c738e437842","fd820c2509bd8a4522d0e0dd7130cce72dff10410942f52b49f693a2caec68a4","8d53d875d634a0102c55b620b501fe9b774e50cec8dbce2f097d08ff95ae256e")

    Reference:    

    https://www.welivesecurity.com/en/eset-research/edr-killers-explained-beyond-the-drivers/


    Tags

    MalwareRansomwareBYOVD

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.