General
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbG5xUFlocUJBR2sxQkpuMUVkSk1URUptQVZOUXxBQ3Jtc0trUll2WkV1MXZhSkF0Y0plOE8yOWFiakU0bVpGeDJxcWt5WUE3U2dvVXptN0VDUDhENXBLQUt0SlRYVi1KMlRKRVEzRG9tdHhzZnNTR29vdERrem9EaWh4SU1ic1FjZEg2VTUwMXM3NWRvVjRFcnFpOA&q=https%3A%2F%2Fgithub.com%2FEndermanch%2FMalwareDatabase%2Fraw%2Fmaster%2FNoEscape.zip&v=4oATWyMMH4A
-
Sample
221219-xma4nsfg54
Malware Config
Targets
-
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbG5xUFlocUJBR2sxQkpuMUVkSk1URUptQVZOUXxBQ3Jtc0trUll2WkV1MXZhSkF0Y0plOE8yOWFiakU0bVpGeDJxcWt5WUE3U2dvVXptN0VDUDhENXBLQUt0SlRYVi1KMlRKRVEzRG9tdHhzZnNTR29vdERrem9EaWh4SU1ic1FjZEg2VTUwMXM3NWRvVjRFcnFpOA&q=https%3A%2F%2Fgithub.com%2FEndermanch%2FMalwareDatabase%2Fraw%2Fmaster%2FNoEscape.zip&v=4oATWyMMH4A
Score8/10-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Registers COM server for autorun
-
Sets file execution options in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-