Severity
High
Analysis Summary
A new ransomware campaign dubbed MegaCortex has been observed targeting business networks corporate networks worldwide. Once a network is penetrated, the attackers infect the entire network by distributing the ransomware using Windows domain controllers. Since it is fairly a new ransomware, currently not much is known about their encryption algorithms, exactly how attackers gain access to the network and how the ransom payments are being acknowledged by the attackers.
Initial infection is speculated to start from the Emotet exploit kit. MegaCortex uses both a manual and automated process starting with Meterpreter reverse shell scripts. From there, PowerShell scripts, batch files and remotely executed commands are utilized to execute the final stage malware on specific machines. Once activated, the malware encrypts files on the machine with an undetermined encryption algorithm.
The ransomware note looks like this:
Impact
Loss of sensitive information
Indicators of Compromise
IP(s) / Hostname(s)
89[.]105[.]198[.]28
Email Address
Malware Hash (MD5/SHA1/SH256)
478dc5a5f934c62a9246f7d1fc275868f568bc07
Remediation