# MountLocker Ransomware v5.0 (XingLocker / Astro Locker) - Worm-Capable RSA-2048/ChaCha20 Locker: Reverse Engineering Analysis

> MountLocker v5.0 is a 64-bit Windows ransomware that encrypts files with ChaCha20 keys protected by a global key wrapped in RSA-2048, kills database/mail services and interfering processes, and can spread as a worm through Active Directory (IDirectorySearch) and WMI/service execution. The same family, branded XingLocker and Astro Locker, has been deployed after IcedID and Cobalt Strike intrusions and drops a RecoveryManual.html ransom note.

- **Published:** 2026-11-04T23:42:32Z
- **Last reviewed:** 2026-11-04T23:42:32Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5280
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5280.png
- **ID:** TL-2026-5280
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** TRACKING
- **Actor:** MountLocker
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

MountLocker (aliases: Mount Locker, Cbtucyny, SunRise Locker, AstroLocker, XingLocker) is a ransomware family first seen around October 2020 according to Elastio. Chuong Dong's May 2021 reverse engineering of v5.0 (MD5 3808f21e56dede99bc914d90aeabe47a, SHA256 4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1) shows a 64-bit executable that runs in local or network mode and exposes a large set of command-line switches: /LOGIN, /PASSWORD, /CONSOLE, /NODEL, /NOKILL, /NOLOG, /SHAREALL, /NETWORK (w = WMI, s = service), /PARAMS, /TARGET, /FAST, /MIN, /MAX, /FULLPD, /MARKER and /NOLOCK. No vulnerability is exploited; the sample relies on standard Windows APIs and has no CVE.

Encryption is hybrid. Each file gets its own ChaCha20 key (CRYPTOGAMS implementation, 'expand 32-byte k' constant); the per-file keys are encrypted with a global ChaCha20 key, and that global key is encrypted with an embedded RSA-2048 public key, so the RSA operation runs once. A 313-byte key buffer and the marker 'lock2' are appended to each encrypted file, and files are processed in 0x100000-byte chunks by one enumeration thread plus two worker threads. Executables and system file types (exe, dll, sys, msi, mui, inf, cat, bat, cmd, ps1, vbs, ttf, fon, lnk) and Windows, Recycle Bin, browser/email profile, temp and Defender paths are skipped. The ransom note is RecoveryManual.html, with a client ID derived from the computer name plus a hardcoded string; Elastio documents the encrypted-file naming pattern .ReadManual.%0.8X.

Before encrypting, the locker stops services whose names contain 'SQL', 'database' or 'msexchange' (OpenSCManagerA, EnumServicesStatusA, ControlService) and terminates 54 processes (database engines such as mysqld.exe and oracle.exe, Office applications, browsers, and analysis tools such as procmon.exe and dumpcap.exe) found via ZwQuerySystemInformation. In worm mode it calls NetGetDCName, builds an LDAP:// path and uses ADsOpenObject/IDirectorySearch to enumerate the domain. It then connects with WNetAddConnection2W, copies itself with CopyFileW to C:\ProgramData on remote hosts (via ADMIN$/IPC$ shares found with NetShareEnum), and launches remotely either as a service (CreateServiceW/StartServiceW) or through WMI (IWbemLocator ConnectServer to ROOT\CIMV2, Win32_Process.Create), using up to 8 worm threads. It removes itself with a temporary batch file (attrib -s -r -h; del /F /Q) unless /NODEL is given.

The DFIR Report (October 2021) documented an IcedID-to-XingLocker intrusion that reached ransomware deployment in about 23-24 hours: IcedID, Cobalt Strike Beacons, AdFind, BloodHound, PowerView and Mimikatz pass-the-hash, antivirus-disabling batch scripts, and finally update64.dll launched by WMIC and batch scripts. Sophos documented the closely related Astro Locker Team, which shared leak-site victims with Mount Locker and used services, batch scripts, scheduled tasks and regsvr32 to run DLLs. Severity is an analyst estimate; no CVSS applies.

## MITRE ATT&CK

- T1566 Phishing
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1047 Windows Management Instrumentation
- T1569.002 Service Execution
- T1106 Native API
- T1053.005 Scheduled Task
- T1543.003 Windows Service
- T1685 Disable or Modify Tools
- T1218.010 Regsvr32
- T1070.004 File Deletion
- T1055 Process Injection
- T1003.001 LSASS Memory
- T1069.002 Domain Groups
- T1482 Domain Trust Discovery
- T1135 Network Share Discovery
- T1057 Process Discovery
- T1021.002 SMB/Windows Admin Shares
- T1550.002 Pass the Hash
- T1489 Service Stop

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Windows Defender Tampering Prior to XingLocker Deployment — Post-Exploitation** (`TL-2026-5280-SPL-002`)

Detects scripted disabling of Windows Defender (Set-MpPreference/Add-MpPreference exclusions, WinDefend service stop, DisableAntiSpyware registry writes, fed1.bat/fed2.bat/fed3.bat) that preceded ransomware launch in the IcedID-to-XingLocker intrusion documented for TL-2026-5280.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1562.001, T1059.001, T1059.003
- **Data sources:** sysmon, windows_process_creation, defender_xdr
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
```Defender/AV tampering used before ransomware deployment in the XingLocker intrusion (fed1.bat, fed2.bat, fed3.bat) - PowerShell, sc/net, reg and batch variants```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
    (((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (CommandLine="*DisableRealtimeMonitoring*" OR CommandLine="*DisableIOAVProtection*" OR CommandLine="*DisableBehaviorMonitoring*" OR (CommandLine="*Add-MpPreference*" CommandLine="*ExclusionPath*")))
    OR ((Image="*\\sc.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe") CommandLine="*WinDefend*" (CommandLine="* stop*" OR CommandLine="*start= disabled*" OR CommandLine="*start=disabled*"))
    OR (Image="*\\reg.exe" CommandLine="*Windows Defender*" (CommandLine="*DisableAntiSpyware*" OR CommandLine="*DisableRealtimeMonitoring*" OR CommandLine="*DisableBehaviorMonitoring*"))
    OR (Image="*\\cmd.exe" (CommandLine="*fed1.bat*" OR CommandLine="*fed2.bat*" OR CommandLine="*fed3.bat*")))
| eval tamper_method=case(match(lower(Image),"(powershell|pwsh)\.exe$"),"powershell_defender_tamper",match(lower(Image),"(sc|net|net1)\.exe$"),"service_windefend_stop",match(lower(Image),"reg\.exe$"),"registry_defender_disable",true(),"fed_bat_script")
| stats count dc(tamper_method) as methods min(_time) as first_seen max(_time) as last_seen values(tamper_method) as tamper_methods values(CommandLine) as command_lines values(ParentImage) as parent_images by host User
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| extend cmd = tolower(ProcessCommandLine)
| extend TamperMethod = case(
    FileName in~ ("powershell.exe", "pwsh.exe") and (cmd matches regex @"disable(realtimemonitoring|ioavprotection|behaviormonitoring)" or (cmd contains "add-mppreference" and cmd contains "exclusionpath")), "powershell_defender_tamper",
    FileName in~ ("sc.exe", "net.exe", "net1.exe") and cmd contains "windefend" and (cmd contains " stop" or cmd contains "disabled"), "service_windefend_stop",
    FileName =~ "reg.exe" and cmd contains "windows defender" and cmd matches regex @"disableantispyware|disablerealtimemonitoring|disablebehaviormonitoring", "registry_defender_disable",
    FileName =~ "cmd.exe" and cmd matches regex @"fed[123]\.bat", "fed_bat_script",
    "")
| where TamperMethod != ""
| project Timestamp, DeviceName, AccountName, TamperMethod, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
```

### Sigma

```yaml
title: Windows Defender Tampering Before MountLocker XingLocker Deployment
id: 5a0c1e2b-5280-4f11-9c02-1a2b3c4d5e02
status: experimental
description: Detects PowerShell, sc/net, reg and batch-script (fed1.bat, fed2.bat, fed3.bat) commands that disable or blind Windows Defender, as seen ahead of XingLocker deployment in The DFIR Report intrusion.
references:
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
    - https://www.chuongdong.com/reverse%20engineering/2021/05/23/MountLockerRansomware/
    - https://www.sophos.com/blog/sophos-mtr-in-real-time-what-is-astro-locker-team
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.defense_evasion
    - attack.t1562.001
    - attack.execution
    - attack.t1059.001
    - attack.t1059.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_ps:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'DisableRealtimeMonitoring'
            - 'DisableIOAVProtection'
            - 'DisableBehaviorMonitoring'
    selection_ps_exclusion_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_ps_exclusion_cmd:
        CommandLine|contains|all:
            - 'Add-MpPreference'
            - 'ExclusionPath'
    selection_sc_img:
        Image|endswith:
            - '\sc.exe'
            - '\net.exe'
            - '\net1.exe'
    selection_sc_svc:
        CommandLine|contains: 'WinDefend'
    selection_sc_action:
        CommandLine|contains:
            - ' stop'
            - 'start= disabled'
            - 'start=disabled'
    selection_reg_img:
        Image|endswith: '\reg.exe'
    selection_reg_key:
        CommandLine|contains: 'Windows Defender'
    selection_reg_value:
        CommandLine|contains:
            - 'DisableAntiSpyware'
            - 'DisableRealtimeMonitoring'
            - 'DisableBehaviorMonitoring'
    selection_fed:
        Image|endswith: '\cmd.exe'
        CommandLine|contains:
            - 'fed1.bat'
            - 'fed2.bat'
            - 'fed3.bat'
    condition: selection_ps or (selection_ps_exclusion_img and selection_ps_exclusion_cmd) or (selection_sc_img and selection_sc_svc and selection_sc_action) or (selection_reg_img and selection_reg_key and selection_reg_value) or selection_fed
falsepositives:
    - Administrators adding approved Defender exclusions for line-of-business software
    - Endpoint management scripts that temporarily change Defender settings during imaging
level: high

```

**Known false positives:**

- Administrators adding approved Defender exclusions via PowerShell
- Golden-image build scripts that disable real-time monitoring temporarily

**Tuning notes:** Exclude known management hosts and service accounts by User or ParentImage. Enable Defender tamper protection so the change itself fails and keep this alert as a signal of intent. Add observed script names beyond fed1-3.bat.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- AdFind / BloodHound / PowerView Domain Discovery — Pre-Ransomware Reconnaissance (locked: unlock with TL Creds)
- Mimikatz LSASS Access and Pass-the-Hash Staging — Credential Access (locked: unlock with TL Creds)
- Cobalt Strike / IcedID C2 Contact — Command and Control (locked: unlock with TL Creds)
- MountLocker/XingLocker Ransom Note and Encrypted File Artifacts — Impact (locked: unlock with TL Creds)
- Database/Exchange Service Stop and Batch Self-Deletion — Pre-Encryption Impact (locked: unlock with TL Creds)
- Remote Admin Share Executable Copy — Worm Lateral Movement (locked: unlock with TL Creds)
- MountLocker/XingLocker Ransomware DLL Launch via Rundll32/Regsvr32 — Execution Phase (locked: unlock with TL Creds)
- MountLocker Worm Remote Execution via WMI or Service from ProgramData — Lateral Movement (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- IP address: `37.120.222[.]100`
- Domain: `gsterangsic[.]buzz`
- File hash: `3808f21e56dede99bc914d90aeabe47a`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [MountLocker Ransomware - Chuong Dong](https://www.chuongdong.com/reverse%20engineering/2021/05/23/MountLockerRansomware/)
- [MountLocker Ransomware - Chuong Dong (GitHub Pages mirror)](https://cdong1012.github.io/reverse%20engineering/2021/05/23/MountLockerRansomware/)
- [IcedID to XingLocker Ransomware in 24 Hours - The DFIR Report](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/)
- [Sophos MTR in Real Time: What is Astro Locker Team?](https://www.sophos.com/blog/sophos-mtr-in-real-time-what-is-astro-locker-team)
- [Elastio - MountLocker Detectable Ransomware](https://elastio.com/detectable-ransomware/mountlocker)
- [Trend Micro - Ransomware Operators Found Using New Franchise Business Model](https://www.trendmicro.com/en_gb/research/21/j/ransomware-operators-found-using-new-franchise-business-model.html)
- [Heimdal Security - MountLocker Ransomware Is Now Using the Windows API](https://heimdalsecurity.com/blog/mountlocker-ransomware-is-now-using-the-windows-api/)
- [Threatpost - Mount Locker Ransomware Changes Tactics](https://threatpost.com/mount-locker-ransomware-changes-tactics/165559/)
- [Security Magazine - Sophos Identifies Connection Between Mount Locker and Astro Locker Team Ransomware](https://securitymagazine.com/articles/94954-sophos-identifies-connection-between-mount-locker-and-astro-locker-team-ransomware)
- [Elastio - MountLocker Ransomware Research](https://elastio.com/ransomware-detection/mountlocker)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5280