A new version of MegaCortex that they have named MegaCortex v2. The malware has undergone a number of changes since the original version. Perhaps most notable is the removal of a password requirement on the main payload that had made it difficult to analyze and limited the malware’s deployment due to requiring it to be manually installed on compromised hosts. With the password now hard-coded in the binary, the malware processes are more automated and may be usable by third parties or affiliated actors. In addition, there are new anti-analysis features and functionality to kill a number of processes related to various security products, which, in the past, were carried out through batch routines. The actors behind the malware make clear in the ransom note they are working for profit, with the ransom demanded being between 2 and 600 Bitcoins which translates to approximately $20,000 to $5.8 million USD.
Malware Hash (MD5/SHA1/SH256)