AVL Code
All cases
#023 · Sample Analysis

Case study · Sample Analysis

Analysis of TheGentlemen Ransomware (Go-Based Double-Extortion Variant)

An incident-response engineer handling a domain-environment ransomware event receives a Go-written, unpacked TheGentlemen ransomware Windows x64 variant under pure-static, zero-execution constraints; in the end they hold a family verdict, the complete attack chain and IOC list, plus three deliverables ready for publication — an MD report, a WeChat-official-account-style HTML report and a print-optimized HTML version.

4.02 MB (4,217,344 bytes) · Go · PE32+ x64 console· Pure static · zero execution in the sandbox· Model: Landi N2.5 (AVL-Zero)· Deliverables: MD report + official-account HTML + print-optimized HTML· Duration: about 7 minutes

View session Download session archive Import into your AVL Code workspace to replay the full conversation View report

Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model

Overview

  1. 01

    Static identification — the TheGentlemen family verdict

    You hand AVL Code the sample hash: it parses the PE, sees through the "packed or not" question, and reaches the family verdict from the ransom-note text, naming the double-extortion family and the threat level.

  2. 02

    Attack-chain reconstruction — the IOC list and two reports

    You watch it trace the PowerShell/GPO/SYSVOL/PsExec propagation chain and its anti-detection capabilities through the strings, and receive a detailed MD report plus an official-account-style HTML report.

  3. 03

    Delivery wrap-up — the print version and the PDF route

    You ask whether it can be converted to PDF: it probes the sandbox boundaries one by one, finds the host’s Edge print path from old PDF metadata, and delivers a print-optimized HTML.

Task for AVL Code

88e824ea42dc271f4992957584b57d64 Produce an analysis report for this sample for me, plus an Antiy CERT official-account-style HTML report and an MD file

Static Identification

Identification starts from the PE and the ransom-note text, with no preset position:

You type → AVL Code 
88e824ea42dc271f4992957584b57d64 Produce an analysis report for this sample for me, plus an Antiy CERT official-account-style HTML report and an MD file
AVL Code runs → you see
PE parsing: 4.02 MB · Go · PE32+ x64 console · unpacked
→ The "packed or not" question is seen through → back to the ransom-note text for the verdict
→ TheGentlemen double-extortion family · threat level Critical

Attack-Chain Reconstruction

It traces the propagation chain and anti-detection capabilities through the strings; two reports take shape in parallel:

You type → AVL Code 
(the same instruction still running, no new input)
AVL Code runs → you see
Embedded PowerShell auto-installs RSAT/GPMC · enumerates domain hosts · GPO scheduled task seeds SYSVOL scripts · embedded PsExec source for lateral movement
→ AMSI bypass · process injection (CreateRemoteThread/NtQueueApcThreadEx) · security-log clearing · database/backup service termination
→ IOC list: 3 hashes · 8 network indicators · 10 file paths · 4 registry paths
→ Delivers the detailed MD report + an Antiy CERT official-account-style HTML

Delivery Wrap-up

Can it be converted to PDF? After probing the sandbox boundaries item by item, one existing path is offered:

You type → AVL Code 
OK — can the HTML file be converted to PDF?
AVL Code runs → you see
No pandoc/python in the sandbox → boundaries probed one by one
→ Finds the host’s Edge print path from old PDF metadata
→ Delivers a print-optimized HTML (Ctrl+P in the browser produces the PDF)

Try it yourself

Put the sample in the workspace of an AVL Code-equipped environment (under workspace samples/), swap the placeholders below for your own sample hash and target style, and the whole process replays.

View session Download session archive Import into your AVL Code workspace to replay the full conversation View report 
<sample MD5> Produce an analysis report for this sample for me, plus a <target style> official-account-style HTML report and an MD file
OK — can the HTML file be converted to PDF?
  • Step 1: pure-static identification + dual-format reports (the sample sits in the workspace samples/ directory).
  • Step 2: when you need a PDF for archiving — the second instruction above.
  • Limitation 1: the session export’s timestamps all equal the export moment, so the "about 7 minutes" duration cannot be independently verified from the session; the figure comes from the existing case entry.
  • Limitation 2: for the IOC counts (3 hashes / 8 network indicators / 10 file paths / 4 registry paths), the complete item-by-item list lives in the delivered report report.pdf; the session body shows only hashes, network indicators and some paths/registry keys — on replay, defer to what your own environment actually extracts.

Next question: With the report delivered, remediation comes next naturally: turn the 8 network indicators and 4 registry Run keys into domain-controller and EDR batch triage/blocking rules, and check whether in-domain GPO objects and the SYSVOL scripts directory have been seeded — want AVL Code to convert this IOC list straight into detection rules?