Overview

overview

8

Static

static

3

Evascape.exe

windows7-x64

8

Evascape.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    Evascape.exe

  • Size

    901KB

  • Sample

    240914-qzse6awgnq

  • MD5

    cb27f76dc0f2d0812e11888a5cddb0c9

  • SHA1

    06a1634a2d10d8b50ff484ed7ce657fbb81831a7

  • SHA256

    40a2414a875132e70c7f79dc75e06d9fe3d0d7dd8e34bd1eeafd80d2fea75d3e

  • SHA512

    23d27b661c797944e1132bc6638bbdb6a2dcb905810f1cc486ca877d983f8e4692677380834f9add6623f5802d006c33c966ab6a04f29f959fdd21ab0d5a57d2

  • SSDEEP

    12288:+ZOS5FM3gKYHqUxxdrDzr1tsLHBNZwM4NaUgWn75wgTTDM1:p+FDKYHLx1rT+uZaUr2gTT

Score
8/10
discoveryevasion

Malware Config

Targets

    • Target

      Evascape.exe

    • Size

      901KB

    • MD5

      cb27f76dc0f2d0812e11888a5cddb0c9

    • SHA1

      06a1634a2d10d8b50ff484ed7ce657fbb81831a7

    • SHA256

      40a2414a875132e70c7f79dc75e06d9fe3d0d7dd8e34bd1eeafd80d2fea75d3e

    • SHA512

      23d27b661c797944e1132bc6638bbdb6a2dcb905810f1cc486ca877d983f8e4692677380834f9add6623f5802d006c33c966ab6a04f29f959fdd21ab0d5a57d2

    • SSDEEP

      12288:+ZOS5FM3gKYHqUxxdrDzr1tsLHBNZwM4NaUgWn75wgTTDM1:p+FDKYHLx1rT+uZaUr2gTT

    Score
    8/10
    discoveryevasion

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks