DFIR Report - The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy

The provided document details an in-depth analysis of the Gentlemen ransomware and its associated activities within a compromised network environment. Here's a summary of key points:

Overview

• Ransomware Type: The Gentlemen ransomware is developed using Go programming language.
• Development Status: Under active development with continuous updates and new features being added.

Command Line Arguments

The malware exposes various command-line options to control its behavior:

• --password: Required argument for initiating the encryption process. Unique per build/infection.
• --path: Specifies directories or disks to target (optional).
• --T: Delay before starting encryption in minutes (optional).
• --silent: Operates silently without renaming files or modifying timestamps post-encryption (optional).
• --wipe: Wipes free space after encryption (optional).
• --keep: Prevents self-deletion after encryption (optional).

Execution Examples

1. Basic execution:

   bash
    
   1$process_name --password QWERTY

2. Targeted directories and delay:

   bash
    
   1$process_name --password QWERTY --path "C:\\,D:\\,\\\\nas\\share" --T 1

Read the full article at Check Point Research

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.