Grixba en-US Locale Geofencing Registry Check for Sandbox Evasion

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects specific registry queries related to 'en-US' custom locale checks, often used by Grixba (Play Ransomware) to identify and evade sandbox environments. The rule also filters for process names matching known Grixba execution patterns or suspicious locations such as Public Music directories.