Analysis of TheGentlemen Ransomware (Go-Based Double-Extortion Variant)
To thoroughly analyze a double-extortion ransomware threat, analysts drove AVL Code with a single natural-language instruction, closing the loop from malicious sample to a complete analysis report.
Built with AVL Code + the Landi model
Overview
Facing a 4.02MB, unpacked Windows x64 variant of TheGentlemen ransomware written in Go, analysts drove AVL Code with one natural-language instruction to reverse-engineer it in depth: identifying its AES-256-CBC + RSA hybrid encryption and its double-extortion scheme via Tor and Clearnet leak blogs (a 239-hour public countdown), reconstructing its embedded PowerShell script that auto-installs RSAT/GPMC, enumerates domain computers, creates a GPO scheduled task to drop the payload into the domain controller's SYSVOL scripts share for domain-wide propagation, then moves laterally via embedded PsExec source, and identifying multiple evasion and destructive capabilities — AMSI bypass, process injection, security-log wiping, and termination of database/backup services. In about 7 minutes it produced a report with a complete IOC list, a threat assessment, and remediation advice, classified as Critical.
Key results
- Fully reverse-engineered the 4.02MB Go-based Windows x64 variant of TheGentlemen ransomware, identifying its AES-256-CBC + RSA hybrid-encryption double-extortion scheme
- Reconstructed the GPO + SYSVOL + PsExec domain-wide automated lateral-movement chain — auto-installing RSAT/GPMC to enumerate domain computers, mass-dropping the payload via a GPO scheduled task into SYSVOL scripts, and executing laterally via PsExec
- Identified multiple evasion and destructive capabilities — AMSI bypass, process injection (CreateRemoteThread/NtQueueApcThreadEx), security-log wiping, and termination of database/backup services
- Extracted a complete IOC list (3 file hashes, 8 network indicators, 10 file paths, 4 registry paths), producing a threat assessment and remediation advice in about 7 minutes, classified as Critical
Technical highlights
Practical value
Helps security operations teams rapidly identify and respond to double-extortion ransomware threats, provides end-to-end guidance from detection to remediation, strengthens detection and handling of domain-wide ransomware attacks, and effectively protects enterprise data assets and business continuity.
Artifacts
Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model