M3rx Ransomware Analysis Details Go Encryptor and Narrow Recovery Paths
Summary
Analysis of a Windows Go-based M3rx sample details its X25519/AES encryption, 0x400-byte file footer and limited recovery conditions. Leak-site victim entries are actor claims; researchers found insufficient public evidence to link M3rx to a known crew or intrusion path
Key points
- Analysis of a PE32+ x64 Go sample found an embedded configuration recoverable through gzip decompression and Go gob decoding.
- The encryptor uses per-run X25519 key exchange, AES-CTR for file contents, and AES-GCM to wrap per-file keys; each encrypted file receives a 0x400-byte footer.
- Encrypted files are renamed with random 16-character basenames and the .8hmlsewu extension; observed behavior also includes dropping RECOVERY_NOTES.TXT, clearing the Recycle Bin, and self-deletion through PowerShell.
- An interrupted file with staging footer magic 0x3828ac45 may retain its plaintext per-file key, offering a narrow recovery possibility.
- Researchers recovered a test file after capturing the running process’s shared secret; they describe this as a limited condition, not a general decryptor.
- M3rx leak-site posts listed six claimed victims as of April 27, 2026, across several countries; the article treats these as actor claims and says public evidence was insufficient to link M3rx to a known crew or intrusion path.
Article Details
- Attack Vectors
- A PE32+ x64 Go ransomware sample encrypts files using per-run X25519 key exchange, AES-CTR for file contents, and AES-GCM to wrap per-file keys.
- The encryptor clears the Recycle Bin, drops RECOVERY_NOTES.TXT in enumerated Desktop and Documents directories, and renames encrypted files with random 16-character basenames and the .8hmlsewu extension.
- The sample can use PowerShell to self-delete. The article does not identify the initial access or intrusion path.
- Defensive Notes
- Interrupted files with staging footer magic 0x3828ac45 may retain the plaintext per-file AES key at record offset +0x18; this is a narrow recovery opportunity.
- The researcher recovered one test file after capturing the runtime X25519 ECDH shared secret, but states this is not a general decryptor.
- The article identifies the sample and embedded-config hashes as detection artifacts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 071e2e0087554d96bba6a4ab73d88cd0 | MD5 of the M3rx Windows Go ransomware sample analyzed in the article. |
| SHA1 | 521b1bd3f30ca50eaee6f74718b97dbe8a49c245 | SHA1 of the M3rx Windows Go ransomware sample analyzed in the article. |
| SHA256 | b09ece33ffe5efb1903526229595a8c74d983c731505bee09c2a005036c834b8 | SHA256 of the M3rx Windows Go ransomware sample analyzed in the article. |
| SHA256 | fc18506bbbbe57fdcecaa424735705501480e6708b634457010a5cf6bdc42525 | SHA256 of the embedded configuration recovered from the M3rx ransomware sample. |
MITRE ATT&CK
T1059.001 · PowerShellThe sample can use PowerShell to execute its self-delete loop.T1070.004 · File DeletionThe ransomware can delete itself through a PowerShell self-delete loop.T1486 · Data Encrypted for ImpactM3rx encrypts file contents with AES-CTR and appends a footer to encrypted files.T1490 · Inhibit System RecoveryThe encryptor clears the Recycle Bin, disrupting recovery of deleted files.
Threat Actors
Malware
Products
Microsoft WindowsM3rx is a newly observed ransomware strain with a public leak site, a Tox contact, and a Windows Go-based encryptor tied to multiple claimed victims across the US, Canada, Australia, the UK, and Switzerland.PowerShellThe PE32+ x64 Go encryptor drops RECOVERY_NOTES.TXT, clears the Recycle Bin, leverages Restart Manager strings, and can self-delete via PowerShell.
Countries
AustraliaM3rx is a newly observed ransomware strain with a public leak site, a Tox contact, and a Windows Go-based encryptor tied to multiple claimed victims across the US, Canada, Australia, the UK, and Switzerland.CanadaM3rx is a newly observed ransomware strain with a public leak site, a Tox contact, and a Windows Go-based encryptor tied to multiple claimed victims across the US, Canada, Australia, the UK, and Switzerland.SwitzerlandM3rx is a newly observed ransomware strain with a public leak site, a Tox contact, and a Windows Go-based encryptor tied to multiple claimed victims across the US, Canada, Australia, the UK, and Switzerland.United KingdomM3rx is a newly observed ransomware strain with a public leak site, a Tox contact, and a Windows Go-based encryptor tied to multiple claimed victims across the US, Canada, Australia, the UK, and Switzerland.United StatesM3rx is a newly observed ransomware strain with a public leak site, a Tox contact, and a Windows Go-based encryptor tied to multiple claimed victims across the US, Canada, Australia, the UK, and Switzerland.