Grixba Security Enumeration, Defense Evasion, and Locale Geofencing (Play Ransomware)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

Detects various phases of the Grixba infostealer infection lifecycle, including persistence via file drops in public user directories, malicious DLL/payload creation, reconnaissance data exfiltration, security software tampering (Windows Defender, AMSI, WLDP), and event log clearing via wevtutil.