M3gac0rtx Ransomware

The M3gac0rtx Ransomware is an updated version of the MegaCortex Ransomware, a file-locking Trojan. Infections will block your opening files such as documents, along with other media. They also may create ransom notes and insert extensions into filenames, among other symptoms. Let anti-malware products protect your PC by removing the M3gac0rtx Ransomware when possible and maintain backups for recovering content freely.

Big-Brained Trojans Reaping More Ransoms

An independent security researcher caught a new variant of the MegaCortex Ransomware, one of the smaller, but still-profitable, families of file-locker Trojans. This version, the M3gac0rtx Ransomware, is continuing its ancestor's pattern of compromising vulnerable business servers and taking over networks by blocking their contents. While the related ransom note doesn't disclose the fee for a decryptor, free alternatives aren't available for this Trojan's family generally.

The M3gac0rtx Ransomware remains Windows-based and temporarily displays a CMD window while it's running. It encrypts files on the computer within seconds securely, including documents, pictures, and other, usual targets. These early versions of the M3gac0rtx Ransomware drop a TXT ransom note, as well, but incorrectly formats it as being an RTF. Users that rename the file appropriately or open it in Notepad will see a traditional extortion message, with e-mail addresses, a 'two file' sample of the decryptor and English-based text. Like most Trojans of its kind, the M3gac0rtx Ransomware also adds an extension ('m3gac0rtx') into the names of the files that it's locking.

There isn't a free decryptor for the MegaCortex Ransomware and variants like the M3gac0rtx Ransomware area expected of being equally obtuse to most recovery solutions. Most file-locking Trojans targeting business entities, also, attack network-available drives and NAS devices. Appropriately strict and well-maintained backup protocols are the only, free solution for file recovery that malware experts can guarantee as working against the M3gac0rtx Ransomware.

Shrinking Mega Trojans Down to Negligible Ones

Previous campaigns related to MegaCortex Ransomware express dependence on Trojan downloaders like Rietspoof. While the M3gac0rtx Ransomware may or may not use similar techniques, taking advantage of third-party tools and Trojans, there are some exploits that malware experts recommend anticipating. Workers should monitor e-mail messages with strange attachments and links and social messaging links with obscured URLs. Admins also should avoid using login credentials that could be at risk of being brute-forced, including 'easy' passwords and factory defaults.

The window the M3gac0rtx Ransomware generates during its encryption routine is a highly-visible symptom, and users who terminate the Trojan in time may save their files. However, encrypting media, even securely, doesn't take much time, and a threat actor may run the program while the machine is unattended or lock the user out of the UI. Anti-malware solutions should block and remove the M3gac0rtx Ransomware under most case effectively unless an attacker terminates them preemptively.

As the spawn of the MegaCortex Ransomware, the M3gac0rtx Ransomware exemplifies a resurgence in the waves of file-locking attacks against businesses who don't monitor their security situations or file storage protocols. Maintaining a backup should be more than a casual habit since making money off of the failure to do so is big business for many Trojans.