Overview

overview

10

Static

static

10

scvhost.exe

windows11-21h2-x64

10

scvhost.exe

windows7-x64

10

scvhost.exe

windows10-2004-x64

10

scvhost.exe

windows10-ltsc_2021-x64

10

scvhost.exe

windows11-21h2-x64

10

Resubmissions

28/03/2025, 16:33

250328-t2z5kayvbw10

25/03/2025, 14:33

250325-rwtz9axvhy10

25/03/2025, 14:30

250325-rt744a1ly810

05/02/2025, 10:34

250205-mmassssng110

05/02/2025, 10:33

250205-mlx7pssnfz10

13/01/2022, 17:53

220113-wgrc2abhgp10

Sharing

Copy URL Twitter E-mail

General

  • Target
    scvhost.exe
  • Size 500KB
  • Sample250325-rt744a1ly8
  • SHA256 5fa8c4ab6dc45672099078277903cce8e86ae1e310f24a0dd9862166e3c0e30c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
mespinoza

Malware Config

Extracted

Family

  • mespinoza

Attributes
  • ransomnote

    Hi Company, Every byte on any types of your devices was encrypted. Don't try to use backups because it were encrypted too. To get all your data back contact us: [email protected] Also, be aware that we downloaded files from your servers and in case of non-payment we will be forced to upload them on our website, and if necessary, we will sell them on the darknet. Check out our website, we just posted there new updates for our partners: http://pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onion/ To go to our site you have to use TOR Browser. Download link: https://www.torproject.org/download/ -------------- FAQ: 1. Q: How can I make sure you don't fooling me? A: You can send us 2 files(max 2mb). 2. Q: What to do to get all data back? A: Don't restart the computer, don't move files and write us. 3. Q: What if I have no response? A: Wait and we will answer you in 24 hours. 4. Q: What to tell my boss? A: Protect Your System Amigo.

Signatures

  • Mespinoza family
    mespinoza
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • scvhost.exe
    .exe 500KB

scvhost.exe

  • IMPHASH b5e8bd2552848bb7bf2f28228d014742
  • SHA256 5fa8c4ab6dc45672099078277903cce8e86ae1e310f24a0dd9862166e3c0e30c
  • MD5 SHA1 SHA512 SSDEEP
windows:5windowsx86arch:x86

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
1
Major OS version
5
Entry point
209097
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths