• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – GermanWiper Ransomware Erases Data, Still Asks for Ransom
August 6, 2019
Rewterz Threat Alert – Phishing Campaign Spreading SODINOKIBI Ransomware
August 7, 2019

Rewterz Threat Alert – New Version of MegaCortex Ransomware

August 7, 2019

Severity

High

Analysis Summary

A new version of MegaCortex that they have named MegaCortex v2. The malware has undergone a number of changes since the original version. Perhaps most notable is the removal of a password requirement on the main payload that had made it difficult to analyze and limited the malware’s deployment due to requiring it to be manually installed on compromised hosts. With the password now hard-coded in the binary, the malware processes are more automated and may be usable by third parties or affiliated actors. In addition, there are new anti-analysis features and functionality to kill a number of processes related to various security products, which, in the past, were carried out through batch routines. The actors behind the malware make clear in the ransom note they are working for profit, with the ransom demanded being between 2 and 600 Bitcoins which translates to approximately $20,000 to $5.8 million USD.

Impact

File encryption

Indicators of Compromise

Malware Hash (MD5/SHA1/SH256)

  • 86aeea7b383e35d4eec0219f031935648ddcf0b257196d3b60e44091ac4e99c2
  • 470a8189915b01bc4012d7e0bdccba8e97a6a2d6
  • 65939a4515a59da3697e4a454d6e8378

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the link/attachments sent by unknown senders.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.