Skip to content

Back to the catalog

DECODING GRIXBA — A PLAY RANSOMWARE SCANNER
theravenfile.comwriteup

DECODING GRIXBA — A PLAY RANSOMWARE SCANNER

A side-by-side reverse-engineering analysis of four Grixba samples (v1 through v3, Sept 2022 to Nov 2024), the custom .NET infostealer/network scanner built by the Play ransomware group to map security tools, credentials, and remote-management software before encryption. The piece traces the binary growth from 164KB to 727KB (adding XOR-encrypted inf_g.dll, SQLite-based ExportData.db output, forged SentinelOne PE metadata, and PIA VPN C2) then its deliberate regression to 118KB to shed public IOCs, backed by MITRE ATT&CK sandbox findings, a shared mutex fingerprint, a weakness scorecard per version, and a full SHA-256/IP/onion IOC table.

TL;DR RE teardown of Play ransomware Grixba scanner across four versions, tracing arms-race evolution with mutex fingerprinting, MITRE ATT&CK findings, and full IOCs.
Open original ↗
Document

What it is

Grixba is a custom .NET infostealer/network scanner built by the Play ransomware group (using Costura for single-executable bundling), used to map compromised networks before encryption. The page tracks four samples over 26 months and, critically for defenders, documents the specific static and behavioral indicators that changed — and those that did not.

The detection trap

The core actionable finding: v2-era hunting rules silently miss v3. After v2 (727 KB) was documented by Symantec (April 2023), Field Effect MDR (January 2025), and CISA (June 2025), its static signatures became widely distributed. The November 2024 v3 sample (118 KB) was deliberately shrunk to sidestep all of them — stripping the bundled SQLite engine and moving heavy scan logic to a separately-staged module.

Signatures that FAIL on v3:

  • Size thresholds tuned to 727 KB
  • Filenames ExportData.db (SQLite output), data.dat, inf_g.dll (XOR-encrypted scan DLL)
  • Forged SentinelOne PE version-info metadata
  • Hash-based rules for the v2 sample

What to do

Pivot to behavioral detection on indicators the page states persist across all four versions:

  • WMI/WinRM host enumeration patterns
  • Fixed drop path C:\Users\Public\Music\
  • PIA VPN egress
  • Mutex CPFATE_2704_v4.0.30319

Sample SHA-256 hashes (v1, v1.5, v2, v3):

453257c3494addafb39cb6815862403e827947a1e7737eb8168cd10522465deb
c59f3c8d61d940b56436c14bc148c1fe98862921b8f7bad97fbc96b31d71193c
f8810179ab033a9b79cd7006c1a74fbcde6ed0451c92fbb8c7ce15b52499353a
3621468d188d4c3e2c6dfe3e9ddcfe3894701666bad918bc195aba0c44e46e94

Note: the v1.5 hash (c59f...) is the one CISA/FBI advisory AA23-352A calls "Play network scanner / Gt_net.exe."

Version timeline

timeline
    v1 (Sep 2022, 164KB) : monolithic infostealer
    v1.5 (Nov 2022, 175KB) : +network scanner (Gt_net.exe / AA23-352A)
    v2 (2023, 727KB) : +XOR inf_g.dll, SQLite, forged SentinelOne PE, expanded AV/EDR/RMM/backup radar
    v3 (Nov 2024, 118KB) : regression - staged module, evades v2 static IOCs

Caveats

  • The "v1.5" label is the author's own designation to distinguish the November 2022 build; it is not vendor-standard nomenclature.
  • The page analyzes the Grixba tool only — it explicitly does not analyze the Play ransomware payload itself.
  • The fetched text cuts off mid-section (feature diffs, capability verdict, weakness scorecard, and a "DPRK connection" section are referenced but not included here), so those claims are unverified from this excerpt.

Organisations named here

  • CISA AA23-352A
  • CPFATE_2704_v4.0.30319
  • Play

Technologies named here

  • Windows
  • Costura
  • .NET Framework 4.x
  • SQLite
  • SentinelOne
  • WinRAR
  • dnSpy/ILSpy
  • CrowdStrike
  • Snort/Suricata
  • Carbon Black
  • YARA
  • Morphisec
  • Private Internet Access VPN
  • MVISION
  • WithSecure
  • WatchGuard
  • FireEye
  • F-Secure
  • Heimdal
  • HitmanPro
  • VIPRE
  • DeepArmor
  • Dr.Web
  • Microsoft Defender
  • NinjaOne
  • Kaseya VSA
  • ConnectWise
  • BeyondTrust
  • GoTo Resolve
  • Splashtop
  • Atera
  • Zoho Assist
  • Action1
  • Pulseway
  • DameWare
  • Radmin
  • TeamViewer
  • AnyDesk
  • IDrive
  • Synology C2
  • Dropbox
  • Veeam
  • .NET
  • WMI
  • RDP
  • MITRE ATT&CK
  • Tor

Techniques named here

  • ntdll.dll unhooking
  • Direct syscalls from unbacked memory
  • AMSI/WLDP bypass via unbacked memory loading
  • PE metadata masquerading
  • XOR-encrypted payload delivery
  • Staged/externalized payload delivery
  • Obfuscated password-protected archive exfiltration
  • C2 via commercial VPN exit node
  • WMI/WinRM/Remote Registry/Remote Services enumeration
  • Windows Event Log clearing
  • RDP-based drop to fixed path
  • Browser history theft over SMB
  • Locale/geofencing check
  • Timezone and shell folder enumeration
  • VEH handler registration + RWX memory creation
  • Architecture flip for evasion
  • Mutex-based execution marker

Threat actors named here

  • Play Ransomware Group
  • Grixba
  • Jumpy Pisces
  • DPRK

Related in Malware & RE