XinglockerMalware
xing use a custom mountlocker exeFrom MISP Galaxy
Last reported 14 months ago, by Huntress1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1047Windows Management Instrumentation
“The commands provided target and disable the two primary Windows Management Instrumentation (WMI) autologgers for Microsoft Defender: the DefenderApiLogger and DefenderAuditLogger.”
- T1053.005Scheduled Task
“Disables all Defender-related scheduled tasks for scanning, cleanup, and maintenance.”
What the reports say
1 report, newest first · the exact sentence from each-
The Commented Kill Chain: Why Old Ransomware Playbooks Never Die“… and allowed us to identify the script's public origin—a Gist on GitHub—and its documented use in past attacks, most notably in a 2021 Xinglocker ransomware case.”
Indicators in its reports
named in the reports aboveCopy this indicator · defanged
Thanks — we review every report.