Pay2Key/Grixba Sandbox Evasion: Timing Delay and Locale Geofence Checks

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•5

This rule detects known evasion techniques used by the Pay2Key and Grixba malware families. It identifies timing-based delays triggered by malicious 'ping.exe' commands targeting invalid IP addresses and locale-based geofencing checks performed via registry queries for custom locale settings.