SYMBOLCOMMON_NAMEaka. SYNONYMS
win.megacortex (Back to overview)

MegaCortex

VTCollection    

Megacortex is a ransomware used in targeted attacks against corporations.
Once the ransomware is run it tries to stop security related services and after that it starts its own encryption process adding a .aes128ctr or .megac0rtx extension to the encrypted files. It is used to be carried from downloaders and trojans, it has no own propagation capabilities.

References
2023-01-05 ⋅ Bleeping Computer ⋅ Bill Toulas
Bitdefender releases free MegaCortex ransomware decryptor
MegaCortex
2021-10-29 ⋅ ⋅ Національна поліція України ⋅ Національна поліція України
Cyberpolice exposes transnational criminal group in causing $ 120 million in damage to foreign companies
Cobalt Strike Dharma LockerGoga MegaCortex TrickBot
2021-10-29 ⋅ Europol ⋅ Europol
12 targeted for involvement in ransomware attacks against critical infrastructure
Cobalt Strike Dharma LockerGoga MegaCortex TrickBot
2021-08-15 ⋅ Symantec ⋅ Threat Hunter Team
The Ransomware Threat
Babuk BlackMatter DarkSide Avaddon Babuk BADHATCH BazarBackdoor BlackMatter Clop Cobalt Strike Conti DarkSide DoppelPaymer Egregor Emotet FiveHands FriedEx Hades IcedID LockBit Maze MegaCortex MimiKatz QakBot RagnarLocker REvil Ryuk TrickBot WastedLocker
2021-02-02 ⋅ ⋅ CRONUP ⋅ Germán Fernández
De ataque con Malware a incidente de Ransomware
Avaddon BazarBackdoor Buer Clop Cobalt Strike Conti DanaBot Dharma Dridex Egregor Emotet Empire Downloader FriedEx GootKit IcedID MegaCortex Nemty Phorpiex PwndLocker PyXie QakBot RansomEXX REvil Ryuk SDBbot SmokeLoader TrickBot Zloader
2020-11-27 ⋅ PTSecurity ⋅ Alexey Vishnyakov, Denis Goydenko
Investigation with a twist: an accidental APT attack and averted data destruction
TwoFace CHINACHOPPER HyperBro MegaCortex MimiKatz
2020-11-20 ⋅ ZDNet ⋅ Catalin Cimpanu
The malware that usually installs ransomware and you need to remove right away
Avaddon BazarBackdoor Buer Clop Cobalt Strike Conti DoppelPaymer Dridex Egregor Emotet FriedEx MegaCortex Phorpiex PwndLocker QakBot Ryuk SDBbot TrickBot Zloader
2020-07-15 ⋅ Mandiant ⋅ Corey Hildebrandt, Daniel Kapellmann Zafra, Keith Lunden, Ken Proska, Nathan Brubaker
Financially Motivated Actors Are Expanding Access Into OT: Analysis of Kill Lists That Include OT Processes Used With Seven Malware Families
Clop DoppelPaymer LockerGoga Maze MegaCortex Nefilim Snake
2020-03-05 ⋅ Microsoft ⋅ Microsoft Threat Protection Intelligence Team
Human-operated ransomware attacks: A preventable disaster
Dharma DoppelPaymer Dridex EternalPetya Gandcrab Hermes LockerGoga MegaCortex MimiKatz REvil RobinHood Ryuk SamSam TrickBot WannaCryptor PARINACOTA
2020-02-20 ⋅ McAfee ⋅ Christiaan Beek, Darren Fitzpatrick, Eamonn Ryan
CSI: Evidence Indicators for Targeted Ransomware Attacks – Part II
Cobalt Strike LockerGoga Maze MegaCortex
2020-01-29 ⋅ ANSSI ⋅ ANSSI
État de la menace rançongiciel
Clop Dharma FriedEx Gandcrab LockerGoga Maze MegaCortex REvil RobinHood Ryuk SamSam
2019-12-24 ⋅ Dev Kundaliya
Warning over LockerGoga and MegaCortex ransomware attacks targeting private industry in western countries
MegaCortex
2019-12-23 ⋅ Bleeping Computer ⋅ Lawrence Abrams
FBI Issues Alert For LockerGoga and MegaCortex Ransomware
LockerGoga MegaCortex
2019-11-05 ⋅ Bleeping Computer ⋅ Lawrence Abrams
New Megacortex Ransomware Changes Windows Passwords, Threatens to Publish Data
MegaCortex
2019-08-05 ⋅ Threatpost ⋅ Tara Seals
MegaCortex Ransomware Revamps for Mass Distribution
MegaCortex
2019-07-19 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Elusive MegaCortex Ransomware Found - Here is What We Know
MegaCortex
2019-05-10 ⋅ SophosLabs Uncut ⋅ Andrew Brandt
MegaCortex, deconstructed: mysteries mount as analysis continues
MegaCortex
2019-05-07 ⋅ Trend Micro ⋅ Trendmicro
MegaCortex Ransomware Spotted Attacking Enterprise Networks
MegaCortex
2019-05-03 ⋅ Sophos ⋅ Andrew Brandt
“MegaCortex” ransomware wants to be The One
MegaCortex
2019-01-01 ⋅ Malwarebytes ⋅ Malwarebytes Labs
Ransom.Megacortex
MegaCortex
Yara Rules
[TLP:WHITE] win_megacortex_auto (20260917 | Detects win.megacortex.)
rule win_megacortex_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.megacortex."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.megacortex"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 898554feffff 8b4518 56 898558feffff 8d855cfeffff 57 50 }
            // n = 7, score = 400
            //   898554feffff         | mov                 dword ptr [ebp - 0x1ac], eax
            //   8b4518               | mov                 eax, dword ptr [ebp + 0x18]
            //   56                   | push                esi
            //   898558feffff         | mov                 dword ptr [ebp - 0x1a8], eax
            //   8d855cfeffff         | lea                 eax, [ebp - 0x1a4]
            //   57                   | push                edi
            //   50                   | push                eax

        $sequence_1 = { b8ffffff7f d1ea 2bc2 3bc8 7607 8bc7 897dfc }
            // n = 7, score = 400
            //   b8ffffff7f           | mov                 eax, 0x7fffffff
            //   d1ea                 | shr                 edx, 1
            //   2bc2                 | sub                 eax, edx
            //   3bc8                 | cmp                 ecx, eax
            //   7607                 | jbe                 9
            //   8bc7                 | mov                 eax, edi
            //   897dfc               | mov                 dword ptr [ebp - 4], edi

        $sequence_2 = { f7da 1bd2 2bce 23ca 03c1 8906 8d45e8 }
            // n = 7, score = 400
            //   f7da                 | neg                 edx
            //   1bd2                 | sbb                 edx, edx
            //   2bce                 | sub                 ecx, esi
            //   23ca                 | and                 ecx, edx
            //   03c1                 | add                 eax, ecx
            //   8906                 | mov                 dword ptr [esi], eax
            //   8d45e8               | lea                 eax, [ebp - 0x18]

        $sequence_3 = { 897db0 8b5f04 8d7704 8b4508 8945cc 8b4d10 8d041e }
            // n = 7, score = 400
            //   897db0               | mov                 dword ptr [ebp - 0x50], edi
            //   8b5f04               | mov                 ebx, dword ptr [edi + 4]
            //   8d7704               | lea                 esi, [edi + 4]
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8945cc               | mov                 dword ptr [ebp - 0x34], eax
            //   8b4d10               | mov                 ecx, dword ptr [ebp + 0x10]
            //   8d041e               | lea                 eax, [esi + ebx]

        $sequence_4 = { 1bc9 23c8 8d45f8 8bd1 2bd0 85c9 b801000000 }
            // n = 7, score = 400
            //   1bc9                 | sbb                 ecx, ecx
            //   23c8                 | and                 ecx, eax
            //   8d45f8               | lea                 eax, [ebp - 8]
            //   8bd1                 | mov                 edx, ecx
            //   2bd0                 | sub                 edx, eax
            //   85c9                 | test                ecx, ecx
            //   b801000000           | mov                 eax, 1

        $sequence_5 = { e8???????? 8b85349cffff 8d8db09cffff 51 8d8d349cffff c645fc02 8b30 }
            // n = 7, score = 400
            //   e8????????           |                     
            //   8b85349cffff         | mov                 eax, dword ptr [ebp - 0x63cc]
            //   8d8db09cffff         | lea                 ecx, [ebp - 0x6350]
            //   51                   | push                ecx
            //   8d8d349cffff         | lea                 ecx, [ebp - 0x63cc]
            //   c645fc02             | mov                 byte ptr [ebp - 4], 2
            //   8b30                 | mov                 esi, dword ptr [eax]

        $sequence_6 = { 6a00 ff15???????? 3b7e30 0f8321140000 8b4e2c 8d462c 03c1 }
            // n = 7, score = 400
            //   6a00                 | push                0
            //   ff15????????         |                     
            //   3b7e30               | cmp                 edi, dword ptr [esi + 0x30]
            //   0f8321140000         | jae                 0x1427
            //   8b4e2c               | mov                 ecx, dword ptr [esi + 0x2c]
            //   8d462c               | lea                 eax, [esi + 0x2c]
            //   03c1                 | add                 eax, ecx

        $sequence_7 = { ffb518ffffff e8???????? 83c418 8d8d5cfeffff 6a01 6a03 }
            // n = 6, score = 400
            //   ffb518ffffff         | push                dword ptr [ebp - 0xe8]
            //   e8????????           |                     
            //   83c418               | add                 esp, 0x18
            //   8d8d5cfeffff         | lea                 ecx, [ebp - 0x1a4]
            //   6a01                 | push                1
            //   6a03                 | push                3

        $sequence_8 = { eb0d 8b4304 03c9 83e001 0bc8 894b04 8b450c }
            // n = 7, score = 400
            //   eb0d                 | jmp                 0xf
            //   8b4304               | mov                 eax, dword ptr [ebx + 4]
            //   03c9                 | add                 ecx, ecx
            //   83e001               | and                 eax, 1
            //   0bc8                 | or                  ecx, eax
            //   894b04               | mov                 dword ptr [ebx + 4], ecx
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]

        $sequence_9 = { c645fc06 e8???????? 57 ff15???????? e9???????? 56 8d8d50fdffff }
            // n = 7, score = 400
            //   c645fc06             | mov                 byte ptr [ebp - 4], 6
            //   e8????????           |                     
            //   57                   | push                edi
            //   ff15????????         |                     
            //   e9????????           |                     
            //   56                   | push                esi
            //   8d8d50fdffff         | lea                 ecx, [ebp - 0x2b0]

    condition:
        7 of them and filesize < 1556480
}
Download all Yara Rules