MountLocker Ransomware v5.0 (XingLocker / Astro Locker) - Worm-Capable RSA-2048/ChaCha20 Locker: Reverse Engineering Analysis

Key facts for MountLocker v5.0 worm

Detection coverage for MountLocker v5.0 worm

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5280 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Windows Defender Tampering Prior to XingLocker Deployment — Post-Exploitation

Detects scripted disabling of Windows Defender (Set-MpPreference/Add-MpPreference exclusions, WinDefend service stop, DisableAntiSpyware registry writes, fed1.bat/fed2.bat/fed3.bat) that preceded ransomware launch in the IcedID-to-XingLocker intrusion documented for TL-2026-5280.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1562.001, T1059.001, T1059.003
• Data sources: sysmon, windows_process_creation, defender_xdr
• Severity: high
• Confidence: high

Splunk SPL

```Defender/AV tampering used before ransomware deployment in the XingLocker intrusion (fed1.bat, fed2.bat, fed3.bat) - PowerShell, sc/net, reg and batch variants```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
    (((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (CommandLine="*DisableRealtimeMonitoring*" OR CommandLine="*DisableIOAVProtection*" OR CommandLine="*DisableBehaviorMonitoring*" OR (CommandLine="*Add-MpPreference*" CommandLine="*ExclusionPath*")))
    OR ((Image="*\\sc.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe") CommandLine="*WinDefend*" (CommandLine="* stop*" OR CommandLine="*start= disabled*" OR CommandLine="*start=disabled*"))
    OR (Image="*\\reg.exe" CommandLine="*Windows Defender*" (CommandLine="*DisableAntiSpyware*" OR CommandLine="*DisableRealtimeMonitoring*" OR CommandLine="*DisableBehaviorMonitoring*"))
    OR (Image="*\\cmd.exe" (CommandLine="*fed1.bat*" OR CommandLine="*fed2.bat*" OR CommandLine="*fed3.bat*")))
| eval tamper_method=case(match(lower(Image),"(powershell|pwsh)\.exe$"),"powershell_defender_tamper",match(lower(Image),"(sc|net|net1)\.exe$"),"service_windefend_stop",match(lower(Image),"reg\.exe$"),"registry_defender_disable",true(),"fed_bat_script")
| stats count dc(tamper_method) as methods min(_time) as first_seen max(_time) as last_seen values(tamper_method) as tamper_methods values(CommandLine) as command_lines values(ParentImage) as parent_images by host User
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| extend cmd = tolower(ProcessCommandLine)
| extend TamperMethod = case(
    FileName in~ ("powershell.exe", "pwsh.exe") and (cmd matches regex @"disable(realtimemonitoring|ioavprotection|behaviormonitoring)" or (cmd contains "add-mppreference" and cmd contains "exclusionpath")), "powershell_defender_tamper",
    FileName in~ ("sc.exe", "net.exe", "net1.exe") and cmd contains "windefend" and (cmd contains " stop" or cmd contains "disabled"), "service_windefend_stop",
    FileName =~ "reg.exe" and cmd contains "windows defender" and cmd matches regex @"disableantispyware|disablerealtimemonitoring|disablebehaviormonitoring", "registry_defender_disable",
    FileName =~ "cmd.exe" and cmd matches regex @"fed[123]\.bat", "fed_bat_script",
    "")
| where TamperMethod != ""
| project Timestamp, DeviceName, AccountName, TamperMethod, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine

Sigma

title: Windows Defender Tampering Before MountLocker XingLocker Deployment
id: 5a0c1e2b-5280-4f11-9c02-1a2b3c4d5e02
status: experimental
description: Detects PowerShell, sc/net, reg and batch-script (fed1.bat, fed2.bat, fed3.bat) commands that disable or blind Windows Defender, as seen ahead of XingLocker deployment in The DFIR Report intrusion.
references:
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
    - https://www.chuongdong.com/reverse%20engineering/2021/05/23/MountLockerRansomware/
    - https://www.sophos.com/blog/sophos-mtr-in-real-time-what-is-astro-locker-team
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.defense_evasion
    - attack.t1562.001
    - attack.execution
    - attack.t1059.001
    - attack.t1059.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_ps:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'DisableRealtimeMonitoring'
            - 'DisableIOAVProtection'
            - 'DisableBehaviorMonitoring'
    selection_ps_exclusion_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_ps_exclusion_cmd:
        CommandLine|contains|all:
            - 'Add-MpPreference'
            - 'ExclusionPath'
    selection_sc_img:
        Image|endswith:
            - '\sc.exe'
            - '\net.exe'
            - '\net1.exe'
    selection_sc_svc:
        CommandLine|contains: 'WinDefend'
    selection_sc_action:
        CommandLine|contains:
            - ' stop'
            - 'start= disabled'
            - 'start=disabled'
    selection_reg_img:
        Image|endswith: '\reg.exe'
    selection_reg_key:
        CommandLine|contains: 'Windows Defender'
    selection_reg_value:
        CommandLine|contains:
            - 'DisableAntiSpyware'
            - 'DisableRealtimeMonitoring'
            - 'DisableBehaviorMonitoring'
    selection_fed:
        Image|endswith: '\cmd.exe'
        CommandLine|contains:
            - 'fed1.bat'
            - 'fed2.bat'
            - 'fed3.bat'
    condition: selection_ps or (selection_ps_exclusion_img and selection_ps_exclusion_cmd) or (selection_sc_img and selection_sc_svc and selection_sc_action) or (selection_reg_img and selection_reg_key and selection_reg_value) or selection_fed
falsepositives:
    - Administrators adding approved Defender exclusions for line-of-business software
    - Endpoint management scripts that temporarily change Defender settings during imaging
level: high

Known false positives:

• Administrators adding approved Defender exclusions via PowerShell
• Golden-image build scripts that disable real-time monitoring temporarily

Tuning notes: Exclude known management hosts and service accounts by User or ParentImage. Enable Defender tamper protection so the change itself fails and keep this alert as a signal of intent. Add observed script names beyond fed1-3.bat.

• 🔒 AdFind / BloodHound / PowerView Domain Discovery — Pre-Ransomware Reconnaissance · unlock with TL Creds
• 🔒 Mimikatz LSASS Access and Pass-the-Hash Staging — Credential Access · unlock with TL Creds
• 🔒 Cobalt Strike / IcedID C2 Contact — Command and Control · unlock with TL Creds
• 🔒 MountLocker/XingLocker Ransom Note and Encrypted File Artifacts — Impact · unlock with TL Creds
• 🔒 Database/Exchange Service Stop and Batch Self-Deletion — Pre-Encryption Impact · unlock with TL Creds
• 🔒 Remote Admin Share Executable Copy — Worm Lateral Movement · unlock with TL Creds
• 🔒 MountLocker/XingLocker Ransomware DLL Launch via Rundll32/Regsvr32 — Execution Phase · unlock with TL Creds
• 🔒 MountLocker Worm Remote Execution via WMI or Service from ProgramData — Lateral Movement · unlock with TL Creds

Indicators of compromise for MountLocker v5.0 worm

As of 2026-11-04, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-5280.

Sample indicators (3 of 30)

• IP address: 37.120.222[.]100
• Domain: gsterangsic[.]buzz
• File hash: 3808f21e56dede99bc914d90aeabe47a

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

How MountLocker v5.0 worm works

The same family, branded XingLocker and Astro Locker, has been deployed after IcedID and Cobalt Strike intrusions and drops a RecoveryManual.html ransom note.

MountLocker (aliases: Mount Locker, Cbtucyny, SunRise Locker, AstroLocker, XingLocker) is a ransomware family first seen around October 2020 according to Elastio. Chuong Dong's May 2021 reverse engineering of v5.0 (MD5 3808f21e56dede99bc914d90aeabe47a, SHA256 4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1) shows a 64-bit executable that runs in local or network mode and exposes a large set of command-line switches: /LOGIN, /PASSWORD, /CONSOLE, /NODEL, /NOKILL, /NOLOG, /SHAREALL, /NETWORK (w = WMI, s = service), /PARAMS, /TARGET, /FAST, /MIN, /MAX, /FULLPD, /MARKER and /NOLOCK. No vulnerability is exploited; the sample relies on standard Windows APIs and has no CVE.

Encryption is hybrid. Each file gets its own ChaCha20 key (CRYPTOGAMS implementation, 'expand 32-byte k' constant); the per-file keys are encrypted with a global ChaCha20 key, and that global key is encrypted with an embedded RSA-2048 public key, so the RSA operation runs once. A 313-byte key buffer and the marker 'lock2' are appended to each encrypted file, and files are processed in 0x100000-byte chunks by one enumeration thread plus two worker threads. Executables and system file types (exe, dll, sys, msi, mui, inf, cat, bat, cmd, ps1, vbs, ttf, fon, lnk) and Windows, Recycle Bin, browser/email profile, temp and Defender paths are skipped. The ransom note is RecoveryManual.html, with a client ID derived from the computer name plus a hardcoded string; Elastio documents the encrypted-file naming pattern .ReadManual.%0.8X.

Before encrypting, the locker stops services whose names contain 'SQL', 'database' or 'msexchange' (OpenSCManagerA, EnumServicesStatusA, ControlService) and terminates 54 processes (database engines such as mysqld.exe and oracle.exe, Office applications, browsers, and analysis tools such as procmon.exe and dumpcap.exe) found via ZwQuerySystemInformation. In worm mode it calls NetGetDCName, builds an LDAP:// path and uses ADsOpenObject/IDirectorySearch to enumerate the domain. It then connects with WNetAddConnection2W, copies itself with CopyFileW to C:\ProgramData on remote hosts (via ADMIN$/IPC$ shares found with NetShareEnum), and launches remotely either as a service (CreateServiceW/StartServiceW) or through WMI (IWbemLocator ConnectServer to ROOT\CIMV2, Win32_Process.Create), using up to 8 worm threads. It removes itself with a temporary batch file (attrib -s -r -h; del /F /Q) unless /NODEL is given.

The DFIR Report (October 2021) documented an IcedID-to-XingLocker intrusion that reached ransomware deployment in about 23-24 hours: IcedID, Cobalt Strike Beacons, AdFind, BloodHound, PowerView and Mimikatz pass-the-hash, antivirus-disabling batch scripts, and finally update64.dll launched by WMIC and batch scripts. Sophos documented the closely related Astro Locker Team, which shared leak-site victims with Mount Locker and used services, batch scripts, scheduled tasks and regsvr32 to run DLLs. Severity is an analyst estimate; no CVSS applies.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 LSASS Memory

Lateral Movement

T1021.002 SMB/Windows Admin Shares; T1550.002 Pass the Hash

Execution

T1047 Windows Management Instrumentation; T1059.001 PowerShell; T1059.003 Windows Command Shell; T1106 Native API; T1569.002 Service Execution

Persistence

T1053.005 Scheduled Task; T1543.003 Windows Service

Defense Evasion

T1055 Process Injection; T1070.004 File Deletion; T1218.010 Regsvr32

Discovery

T1057 Process Discovery; T1069.002 Domain Groups; T1135 Network Share Discovery; T1482 Domain Trust Discovery

Impact

T1489 Service Stop

Initial Access

T1566 Phishing

defense-impairment

T1685 Disable or Modify Tools

Remediation for MountLocker v5.0 worm

Immediate actions

• Block the listed C2 IPs and domains at the perimeter and hunt for the file hashes and filenames in the IOC list
• Hunt for RecoveryManual.html, files named *.ReadManual.<8 hex>, and the 'lock2' marker at the end of recently modified files
• Alert on remote service creation and WMI Win32_Process.Create launching a binary from C:\ProgramData on multiple hosts
• Isolate hosts and reset credentials (including domain admin) if Cobalt Strike, IcedID or Mimikatz activity is found

Workarounds

• Enable Windows Defender tamper protection and attack surface reduction rules for PsExec/WMI process creation
• Restrict WMI remote execution and remote service creation to approved management hosts

Longer-term hardening

• Restrict ADMIN$/IPC$ and SMB access between workstations and limit local administrator reuse
• Deploy EDR with tamper protection to stop batch-script AV and Windows Defender disabling
• Keep offline, tested backups of database and Exchange servers
• Monitor regsvr32/rundll32 loading DLLs from user-writable paths such as C:\Users\Public\Music

Affected and fixed versions

• Microsoft — Windows (64-bit), including Active Directory domain environments
  Vulnerable versions: Windows systems reachable by the locker; no specific version restriction stated in sources

Timeline of MountLocker v5.0 worm

• 2020-10-01 MountLocker first seen in the wild according to Elastio's ransomware profile.
• 2021-03-01 In March 2021 the Astro Locker group emerges using a customized MountLocker executable with ransom notes pointing to its own payment and leak sites; all five victims on its leak site also appear on the Mount Locker site (Sophos, as reported by Security Magazine/Infosecurity).
• 2021-05-01 In May 2021 a third group, XingLocker, appears as a re-branded MountLocker build whose ransom note points victims to a different Tor onion service (Trend Micro franchise-model research).
• 2021-05-23 Chuong Dong publishes a reverse engineering analysis of MountLocker v5.0, documenting RSA-2048/ChaCha20 encryption, worm propagation via IDirectorySearch and WMI/service execution, and the command-line switches.
• 2021-07-19 Cobalt Strike C2 locked-ioc-23 (locked-ioc-28), later seen in an IcedID-to-XingLocker intrusion, is added to a threat feed per The DFIR Report.
• 2021-07-27 Cobalt Strike C2 locked-ioc-24 (locked-ioc-19) is added to a threat feed per The DFIR Report.
• 2021-10-18 The DFIR Report publishes an intrusion in which IcedID led to Cobalt Strike (about 2 hours), AdFind/BloodHound/Mimikatz, AV-disabling scripts and XingLocker deployment via WMIC and batch scripts about 23 hours after initial infection.

Sources cited for MountLocker v5.0 worm

• MountLocker Ransomware - Chuong Dong chuongdong.com · Research · 2021-05-23
• IcedID to XingLocker Ransomware in 24 Hours - The DFIR Report thedfirreport.com · Research · 2021-10-18
• Sophos MTR in Real Time: What is Astro Locker Team? Sophos · Vendor report
• Elastio - MountLocker Detectable Ransomware elastio.com · Vendor report
• Trend Micro - Ransomware Operators Found Using New Franchise Business Model Trend Micro · Vendor report
• Elastio - MountLocker Ransomware Research elastio.com · Research
• MountLocker Ransomware - Chuong Dong (GitHub Pages mirror) cdong1012.github.io · Blog · 2021-05-23
• Heimdal Security - MountLocker Ransomware Is Now Using the Windows API heimdalsecurity.com · Blog
• Threatpost - Mount Locker Ransomware Changes Tactics threatpost.com · News
• Security Magazine - Sophos Identifies Connection Between Mount Locker and Astro Locker Team Ransomware securitymagazine.com · News

More in ransomware

• Halcyon August 2026 Ransomware Report: 10 of Top 15 Families New vs. July; Manufacturing Top Target
• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated

Previous and next in ransomware

• LockBit Ransomware v4.0 (LockBitGreen4.0-rc-577) Reverse Engineering Analysis Previous report
• Darkside Ransomware v1.8.6.2 - Reverse Engineering Analysis Next report