Pierluigi Paganini
May 07, 2019
Security experts at Sophos discovered a new piece of ransomware dubbed MegaCortex that is targeting corporate networks.
MegaCortex attacks were already reported in the United States, Italy, Canada, France, the Netherlands, and Ireland.
“A new
“The convoluted infection methodology MegaCortex employs leverages both automated and manual components, and appears to involve a high amount of automation to infect a greater number of victims.”
MegaCortex was first spotted in January when a sample of the ransomware was uploaded on the online scanning service VirusTotal.
Experts noticed a spike in the number of attacks last week when detected and halted 47 attacks (Since January the overall number of attack based on MegaCortex is 76).
At the time of the report is still unclear the attack chain, anyway, researchers found a correlation between the MegaCortex attacks and the presence in the same network of both Emotet and Qbot (aka Qakbot) malware.
“Right now, we can’t say for certain whether the MegaCortex attacks are being aided and abetted by the Emotet malware, but so far in our investigation (which is still ongoing as this post goes live), there seems to be a correlation between the MegaCortex attacks and the presence on the same network of both Emotet and Qbot (aka Qakbot) malware.” continues the report.
Some of the victims of the ransomware reported they had the domain controllers compromised, this could be a first step of the attack.
Then crooks leverage on Cobalt Strike script that opens a Meterpreter reverse shell into the target network.
The access to the compromised domain controller (DC) allows the attackers to issue commands. The Domain Controller uses WMI to push the malware, a copy of PsExec renamed rstwg.exe, and a batch file to the machines on the machine reachable in the same network and then runs the batch file remotely via PsExec.
The batch file includes a long list of commands used by the attackers to kill 44 processes, issue stop commands to 189 different services, and switch the Startup Type for 194 different services to Disabled, which prevents them from starting up again.
Then the malicious code will execute the main malware file called winnit.exe.
“This command invokes winnit.exe to drop and execute a DLL payload with an eight-random-alphabetic character filename that performs the hostile encryption.” reads the analysis published by Sophos. “There are also indications the attackers use other batch files, named
The MegaCortex ransomware leaves a ransom note on the root of the victim’s hard drive.
The Megacortex ransomware generates a file with a .tsv file extension and the same eight-random-letter filename as the malicious DLL and leaves it to the hard drive.
The victims have to submit this file with their request to pay the ransom to the attackers via two free mail.com email addresses.
Experts pointed out that the ransom note doesn’t mention a ransom price the crooks are demanding, instead they offer the victims “a consultation on how to improve your companies (sic) cyber security” and “a guarantee that your company will never be inconvenienced by us.”
“The softwares price will include a guarantee that your company will never be inconvenienced by us. You will also receive a consultation on how to improve your companies cyber security.”
Further technical details, including Indicators of Compromise (IoCs), are reported in the analysis published by Sophos.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Megacortex ransomware, cybercrime)
[adrotate banner=”5″]
[adrotate banner=”13″]
