mespinoza | 7fd3000a3afbf077589c300f90b59864ec1fb716feba8e288ed87291c8fdf7c3 | Triage

Sharing

General

Target

7fd3000a3afbf077589c300f90b59864ec1fb716feba8e288ed87291c8fdf7c3
Size

500KB
Sample

210408-93rqtbljcs
MD5

f812e7d373c3bf1f449560b88cfbb6bb
SHA1

f7d7567d1721478eee276001aeeba44473a713ef
SHA256

7fd3000a3afbf077589c300f90b59864ec1fb716feba8e288ed87291c8fdf7c3
SHA512

31abccfb4e6491999943c4710c6c77b8d8fb2b1b3947b11f7867a8e778c8f70b0515cf13b9daca034088367d6616b4d3be7343f1526cd066cb530daa9d18154f

Score

10^/10

mespinoza ransomware spyware stealer

Malware Config

Targets

- Target
  
  7fd3000a3afbf077589c300f90b59864ec1fb716feba8e288ed87291c8fdf7c3
- Size
  
  500KB
- MD5
  
  f812e7d373c3bf1f449560b88cfbb6bb
- SHA1
  
  f7d7567d1721478eee276001aeeba44473a713ef
- SHA256
  
  7fd3000a3afbf077589c300f90b59864ec1fb716feba8e288ed87291c8fdf7c3
- SHA512
  
  31abccfb4e6491999943c4710c6c77b8d8fb2b1b3947b11f7867a8e778c8f70b0515cf13b9daca034088367d6616b4d3be7343f1526cd066cb530daa9d18154f
Score

10^/10

mespinoza ransomware spyware stealer
- Mespinoza Ransomware
  Also known as Pysa. Ransomware-as-a-servoce which first appeared in 2020.
  ransomware mespinoza
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Data Encrypted for Impact

Tasks

static1

behavioral1

mespinozaransomwarespywarestealer

behavioral2

mespinozaransomwarespywarestealer