mespinoza | 48355bd2a57d92e017bdada911a4b31aa7225c0b12231c9cbda6717616abaea3[.]zip

General

Target
48355bd2a57d92e017bdada911a4b31aa7225c0b12231c9cbda6717616abaea3.zip
Size 235KB
Sample260805-nejamswelf
SHA256 0b9e0cc86eb1a8dd103c447d6643cf3b7ef3f16dab9549f7ef756cd127749a42
MD5 0f9d485bd239eb8191971118122eff92
SHA1 8af55644fd1dbe6da834890995469825b2ebe56a
SHA512 2e2296990705b06044ad6d2dc0920b96b79b4004a3d331bca39722a303beb4ad6bd3dc1216f4fdb83a4a628a0ed1416528176c9d8679e57c951ac5c0e0d5b50d
SSDEEP 6144:5bbnXTSw5/fK4Rk6vKhSBVurucISsKWNINRs6ROCY:5bnXGwBdk0BZTKWNINRs+Y
TLSH
T1373413B535102F4C148A86333F18DA39DA893C49F4DE3A30590D15CE756A97EE68FEB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ransomware mespinoza

Malware Config

Extracted

Family

mespinoza

Attributes

ransomnote
Hi Company, Every byte on any types of your devices was encrypted. Don't try to use backups because it were encrypted too. To get all your data back contact us: [email protected] [email protected] -------------- FAQ: 1. Q: How can I make sure you don't fooling me? A: You can send us 2 files(max 2mb). 2. Q: What to do to get all data back? A: Don't restart the computer, don't move files and write us. 3. Q: What to tell my boss? A: Protect Your System Amigo.

Signatures

Family: Mespinoza Ransomware
Also known as Pysa. Ransomware-as-a-servoce which first appeared in 2020.
ransomware mespinoza

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/48355bd2a57d92e017bdada911a4b31aa7225c0b12231c9cbda6717616abaea3.exe

File Explorer

48355bd2a57d92e017bdada911a4b31aa7225c0b12231c9cbda6717616abaea3.zip

.zip 235KB
48355bd2a57d92e017bdada911a4b31aa7225c0b12231c9cbda6717616abaea3.exe

.exe 499KB

48355bd2a57d92e017bdada911a4b31aa7225c0b12231c9cbda6717616abaea3.zip

SHA256 0b9e0cc86eb1a8dd103c447d6643cf3b7ef3f16dab9549f7ef756cd127749a42
MD5 0f9d485bd239eb8191971118122eff92
SHA1 8af55644fd1dbe6da834890995469825b2ebe56a
SHA512 2e2296990705b06044ad6d2dc0920b96b79b4004a3d331bca39722a303beb4ad6bd3dc1216f4fdb83a4a628a0ed1416528176c9d8679e57c951ac5c0e0d5b50d
SSDEEP 6144:5bbnXTSw5/fK4Rk6vKhSBVurucISsKWNINRs6ROCY:5bnXGwBdk0BZTKWNINRs+Y
TLSH
T1373413B535102F4C148A86333F18DA39DA893C49F4DE3A30590D15CE756A97EE68FEB4
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

48355bd2a57d92e017bdada911a4b31aa7225c0b12231c9cbda6717616abaea3.exe

IMPHASH b5e8bd2552848bb7bf2f28228d014742
SHA256 48355bd2a57d92e017bdada911a4b31aa7225c0b12231c9cbda6717616abaea3
MD5 4ff21b1cec174bbb5bf0b22e42a56af0
SHA1 3c7ae5cfc9053284c73aa34819fd47fd7bc40cc7
SHA512 96a93838cedd0c9d847ca975ad7728e7bfa3662a29564ead784c2fbefc436a850aa2f9d218587a8130c1a08d5cf745ebd3b5c41afa8cda8f733086507f987c84
SSDEEP 12288:KMov9f279P+OeO+OeNhBBhhBBmBRW3aHhIBiVMbD1fsxGJ:Tov9+xBRW3+hIIVERwG
TLSH
T1A3B47C60B573D072C96294F54E3DBA4A742DAC940B659BFBB3DC2A2D1DB40C01B32EE5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

208697

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA GetFileAttributesExW FindFirstFileW FindNextFileW ReleaseMutex CreateMutexA OpenMutexA FreeConsole HeapAlloc HeapFree GetProcessHeap GetTempPathA CreateThread WaitForMultipleObjects GetLastError SetLastError QueryPerformanceCounter QueryPerformanceFrequency CreateFileW ReadConsoleW WriteConsoleW GetDriveTypeW GetModuleFileNameA GetLogicalDriveStringsW CloseHandle FindClose ExitProcess WriteFile SetStdHandle WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent ResetEvent WaitForSingleObjectEx InitializeSListHead IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess GetCurrentProcessId GetCurrentThreadId InterlockedPushEntrySList RaiseException RtlUnwind FreeLibrary LoadLibraryExW MoveFileExW HeapReAlloc GetModuleHandleExW GetStdHandle GetCommandLineA GetCommandLineW GetACP IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx HeapSize FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEndOfFile

user32

wsprintfW wsprintfA

advapi32

CryptReleaseContext CryptAcquireContextA RegSetValueExA RegOpenKeyExA RegCloseKey CryptGenRandom

shell32

ShellExecuteA

Name

.text

Size

352KB

Virtual Size

352KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

48355bd2a57d92e017bdada911a4b31aa7225c0b12231c9cbda6717616abaea3.zip

48355bd2a57d92e017bdada911a4b31aa7225c0b12231c9cbda6717616abaea3.exe

kernel32

user32

advapi32

shell32

generic