We're still trying to develop a clearer picture of the infection process, but for now, it appears that there's a strong correlation between the presence of MegaCortex, and a pre-existing, ongoing infection on the victims' networks with both Emotet and Qbot. Keeping regular backups of your most important and current data on an offline storage device is the best way to avoid having to pay a ransom altogether.

• IP: 89.105.198.28
• File Hashes:
• 37b4496e650b3994312c838435013560b3ca8571 (Batch file)
  
• 478dc5a5f934c62a9246f7d1fc275868f568bc07 (PE.exe)
  
• 2f40abbb4f78e77745f0e657a19903fc953cc664 (DLL Memory Injection)
  
• 53dddbb304c79ae293f98e0b151c6b28
• 65939a4515a59da3697e4a454d6e8378
• 470a8189915b01bc4012d7e0bdccba8e97a6a2d6
• 2632529b0fb7ed46461c406f733c047a6cd4c591
• 86aeea7b383e35d4eec0219f031935648ddcf0b257196d3b60e44091ac4e99c2
• 873aa376573288fcf56711b5689f9d2cf457b76bbc93d4e40ef9d7a27b7be466

1. Add the ip address to the firewalls and servers
   
• InBound Server Rules - (New-Netfirewallrule -Action Block -Enabled True -Direction Inbound -RemoteAddress 89.105.198.28 -Name MegaCortex-In -Profile Any -Protocol Any -DisplayName "Block MegaCortex In")
• OutBound Server Rules - (New-Netfirewallrule -Action Block -Enabled True -Direction Outbound -RemoteAddress 89.105.198.28 -Name MegaCortex-Out -Profile Any -Protocol Any -DisplayName "Block MegaCortex Out")
  
2. Ensure you have installed a HIDS application to filter applications from starting or being written to
   
• c:\nxahoft_G9.log
• c:\!!!_READ-ME_!!!.txt
• C:\x5gj5_gmG8.log
3. Also, the user could run this powershell script to look for the additional hashes (wrote code below to identify the hashes on the system using Powershell)
   

$1 = @("53dddbb304c79ae293f98e0b151c6b28", 
"65939a4515a59da3697e4a454d6e8378", 
"470a8189915b01bc4012d7e0bdccba8e97a6a2d6", 
"2632529b0fb7ed46461c406f733c047a6cd4c591", 
"86aeea7b383e35d4eec0219f031935648ddcf0b257196d3b60e44091ac4e99c2", 
"873aa376573288fcf56711b5689f9d2cf457b76bbc93d4e40ef9d7a27b7be466")

$hash = (get-childitem -path c:\*.* | get-filehash).path 
# Add -recurse c:\*.* -recurse to look for all directories
foreach ($i in $hash) {
foreach ($j in $1) {
if ( (Get-filehash -path $i).hash -eq $j) {
Write-Host $i "MegaCortext file found"
Remove-item $i -force
Write-Host $i "MegaCortext file removed"
}
} Write-Host "MegaCortext files not found"
}