MegaCortexMalware
Megacortex is a ransomware used in targeted attacks against corporations. Once the ransomware is run it tries to stop security related services and after that it starts its own encryption process adding a.aes128ctr or.megac0rtx extension to the encrypted files. It is used to be carried from downloaders and trojans, it has no own propagation capabilities.From MISP Galaxy
Last reported 1 month ago, by Risky Business News2 reports
ATT&CK techniques
6 of 35 · each with the sentence it comes from- T1003OS Credential Dumping
“Credential Dumping (T1003), Brute Force (T1110), Input Capture (T1056)”
- T1005Data from Local System
“Data from Local System (T1005), Data from Network Shared Drive (T1039), Data Staged (T1074)”
- T1018Remote System Discovery
“…1482), File and Directory Discovery (T1083), Network Service Scanning (T1046), Network Share Discovery (T1135), Remote System Discovery (T1018)”
- T1021.001Remote Desktop Protocol
“ProLock operators used two main vectors of initial access: QakBot (Qbot) and unprotected Remote Desktop Protocol (RDP)-servers with weak credentials.”
- T1036Masquerading
“…Signing (T1116), Deobfuscate/Decode Files or Information (T1140), Disabling Security Tools (T1089), File Deletion (T1107), Masquerading (T1036), Process Injection (T1055)”
- T1039Data from Network Shared Drive
“Data from Local System (T1005), Data from Network Shared Drive (T1039), Data Staged (T1074)”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Risky Bulletin: Gemini hacked three companies too“Authorities say the 52-year-old IT specialist worked as a coder for the LockerGoga, MegaCortex and Nefilim ransomware groups.”
-
ATT&CKing ProLock Ransomware“The more interesting initial access vector is QakBot, a trojan that was at one point affiliated with the MegaCortex ransomware family.”
Indicators in its reports
named in the reports above- itorrents[.]orgin 1 report
Copy this indicator · defanged
Thanks — we review every report.