Analysis Tracks Grixba’s Evolution Across Four Play Ransomware Samples

Summary

The analysis tracks four Grixba samples from 2022–2024, describing shifts from a .NET infostealer to modular reconnaissance and a smaller staged loader, while WMI/WinRM enumeration and an RDP drop path remain detection opportunities.

Key points

The analysis compares four samples spanning 2022–2024; their reported sizes grew from 164 KB to 727 KB before shrinking to 118 KB.
The v1.5 sample added active host scanning and browser-history path enumeration over SMB; the article says CISA Snort rules detect the listed paths.
In v2, scanning logic moved into an XOR-encrypted inf_g.dll delivered in data.dat; the tool also adopted SQLite output, forged SentinelOne metadata, and a PIA VPN endpoint.
The v3 account describes removal of the bundled SQLite engine and externalized staged payload delivery; the article notes these architectural conclusions are partly inferred and that the specific hash lacked a full public technical analysis.
The analysis reports WMI/WinRM enumeration and writes to C:UsersPublicMusic via RDP as behaviors retained across all four versions.
The samples also reportedly modify ntdll.dll memory protection; the article recommends behavior-based detections rather than relying on version-specific file sizes or artifacts.

Article Details

Attack Vectors: Play Ransomware used Grixba to enumerate hosts, software, users, security products, backup systems, and remote-management tools before encryption.
Grixba used WMI and WinRM for network enumeration; version 1.5 also scanned IP ranges for reachable hosts and services.
Version 1.5 accessed browser-history paths over SMB.
The tool was delivered via RDP to C:\Users\Public\Music.
Version 2 communicated with 84.239.41.12, identified in the article as a PIA VPN exit node used as a C2 and exfiltration channel.
Version 3 used a separately delivered scanning payload; the article says scanning depended on that second stage succeeding.
Grixba modified ntdll.dll memory protection to unhook EDR instrumentation and cleared Windows event logs.
Defensive Notes: Monitor executable writes to C:\Users\Public\Music from RDP sessions.
Detect rapid WMI and WinRM connections from one host to multiple targets, especially when used for software and security-product enumeration.
Correlate ntdll.dll memory-protection changes, VEH registration, RWX memory creation, and the en-US locale registry check as the article's cross-version behavior pattern.
Watch for connections to 84.239.41.12, which the article identifies as a PIA VPN exit node used by Grixba as a C2 endpoint.
Do not rely only on version 2 file-size, filename, or artifact signatures; the article reports that later versions changed packaging and payload delivery.
Look for Windows event-log clearing behavior and password-protected data.zip archives.

Indicators of compromise

Type	Indicator	Context
IPV4	`84[.]239[.]41[.]12`	PIA VPN exit-node IP that the article reports Grixba v2 used as a C2 and exfiltration endpoint; the article does not claim the VPN provider owns or controls the malicious activity.
SHA256	`3621468d188d4c3e2c6dfe3e9ddcfe3894701666bad918bc195aba0c44e46e94`	SHA-256 hash of one of the Grixba samples analyzed in the article.
SHA256	`453257c3494addafb39cb6815862403e827947a1e7737eb8168cd10522465deb`	SHA-256 hash of one of the Grixba samples analyzed in the article.
SHA256	`c59f3c8d61d940b56436c14bc148c1fe98862921b8f7bad97fbc96b31d71193c`	SHA-256 hash of the November 2022 Grixba v1.5 sample, identified in the article as a Play network scanner.
SHA256	`f8810179ab033a9b79cd7006c1a74fbcde6ed0451c92fbb8c7ce15b52499353a`	SHA-256 hash of one of the Grixba samples analyzed in the article.