Overview

overview

10

Static

static

10

48355bd2a5...a3.exe

windows10-2004-x64

10

48355bd2a5...a3.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    48355bd2a57d92e017bdada911a4b31aa7225c0b12231c9cbda6717616abaea3.zip
  • Size 235KB
  • Sample260805-nejamswelf
  • SHA256 0b9e0cc86eb1a8dd103c447d6643cf3b7ef3f16dab9549f7ef756cd127749a42
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
mespinozadefense_evasiondiscoveryexecutionransomwarespywarestealer

Malware Config

Extracted

Family

  • mespinoza

Attributes
  • ransomnote

    Hi Company, Every byte on any types of your devices was encrypted. Don't try to use backups because it were encrypted too. To get all your data back contact us: [email protected] [email protected] -------------- FAQ: 1. Q: How can I make sure you don't fooling me? A: You can send us 2 files(max 2mb). 2. Q: What to do to get all data back? A: Don't restart the computer, don't move files and write us. 3. Q: What to tell my boss? A: Protect Your System Amigo.

Extracted

Path

  • C:\Users\Readme.README

Ransom Note
  • Hi Company, Every byte on any types of your devices was encrypted. Don't try to use backups because it were encrypted too. To get all your data back contact us: [email protected] [email protected] -------------- FAQ: 1. Q: How can I make sure you don't fooling me? A: You can send us 2 files(max 2mb). 2. Q: What to do to get all data back? A: Don't restart the computer, don't move files and write us. 3. Q: What to tell my boss? A: Protect Your System Amigo.

Targets

    • Target
      48355bd2a57d92e017bdada911a4b31aa7225c0b12231c9cbda6717616abaea3.exe
    • Size 499KB
    • SHA256 48355bd2a57d92e017bdada911a4b31aa7225c0b12231c9cbda6717616abaea3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionmespinozaransomwarespywarestealer

    • Family: Mespinoza Ransomware

      Also known as Pysa. Ransomware-as-a-servoce which first appeared in 2020.

      ransomwaremespinoza

    • Renames multiple (3740) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks