Executive Summary
NoEscape is a destructive wiper and screen-locking malware derived from a public GitHub project. It is attributed based on embedded strings to authors MARUF, ENDERMAN, and LEURAK. Unlike traditional ransomware, NoEscape lacks a financial motivation or payment mechanism, focusing instead on system disruption and data destruction through raw disk access and account sabotage.
The attack chain involves establishing UI persistence by disabling system tools (Task Manager, UAC), hijacking the .exe file association to ensure continuous re-infection, and renaming the local administrator account to lock out users. The malware defaces the system with taunting messages and fake notifications before attempting to wipe data using raw access to the physical drive.
While the malware presents a juvenile persona, its impact is high due to its ability to bypass ACLs by taking ownership of system folders and overwriting the Master Boot Record or disk sectors directly via the PhysicalDrive0 handle.