Rewterz Threat Alert – New Version of MegaCortex Ransomware

Severity

High

Analysis Summary

A new version of MegaCortex that they have named MegaCortex v2. The malware has undergone a number of changes since the original version. Perhaps most notable is the removal of a password requirement on the main payload that had made it difficult to analyze and limited the malware’s deployment due to requiring it to be manually installed on compromised hosts. With the password now hard-coded in the binary, the malware processes are more automated and may be usable by third parties or affiliated actors. In addition, there are new anti-analysis features and functionality to kill a number of processes related to various security products, which, in the past, were carried out through batch routines. The actors behind the malware make clear in the ransom note they are working for profit, with the ransom demanded being between 2 and 600 Bitcoins which translates to approximately $20,000 to $5.8 million USD.

Impact

File encryption

Indicators of Compromise

Malware Hash (MD5/SHA1/SH256)

• 86aeea7b383e35d4eec0219f031935648ddcf0b257196d3b60e44091ac4e99c2
• 470a8189915b01bc4012d7e0bdccba8e97a6a2d6
• 65939a4515a59da3697e4a454d6e8378

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the link/attachments sent by unknown senders.