Pysa

Compare

View crypto

Description

Mespinosa is a ransomware which encrypts file using an asymmetric encryption and adds .pysa as file extension. According to dissectingmalware the extension "pysa" is probably derived from the Zanzibari Coin with the same name.

External Analysis33
External Analysis
https://www.ic3.gov/Media/News/2021/210316.pdf
https://blog.malwarebytes.com/threat-spotlight/2021/03/pysa-the-ransomware-attacking-schools
http://www.secureworks.com/research/threat-profiles/gold-burlap
https://blog.cyble.com/2021/11/29/pysa-ransomware-under-the-lens-a-deep-dive-analysis/
https://blogs.blackberry.com/en/2021/06/pysa-loves-chachi-a-new-golang-rat
https://dissectingmalwa.re/another-one-for-the-collection-mespinoza-pysa-ransomware.html
https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3
https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf
https://id-ransomware.blogspot.com/2019/10/mespinoza-ransomware.html
https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf
https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/
https://securelist.com/modern-ransomware-groups-ttps/106824/
https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/
https://twitter.com/campuscodi/status/1347223969984897026
https://twitter.com/inversecos/status/1456486725664993287
https://unit42.paloaltonetworks.com/gasket-and-magicsocks-tools-install-mespinoza-ransomware/
https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/
https://www.bleepingcomputer.com/news/security/ransomware-gangs-script-shows-exactly-the-files-theyre-after/
https://www.cert.ssi.gouv.fr/cti/CERTFR-2020-CTI-002/
https://www.cybereason.com/blog/threat-analysis-report-inside-the-destructive-pysa-ransomware
https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/
https://www.hhs.gov/sites/default/files/mespinoza-goldburlap-cyborgspider-analystnote-tlpwhite.pdf
https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/
https://www.ic3.gov/Media/News/2021/210316.pdf
https://www.lacework.com/blog/pysa-ransomware-gang-adds-linux-support/
https://www.prodaft.com/m/reports/PYSA_TLPWHITE_3.0.pdf
https://www.prodaft.com/resource/detail/pysa-ransomware-group-depth-analysis
https://www.sentinelone.com/blog/from-the-front-lines-peering-into-a-pysa-ransomware-attack/
https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html
https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf
https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf
https://www.zdnet.com/article/france-warns-of-new-ransomware-gang-targeting-local-governments/
Urls1
Url
Status
Screen
Uptime 30d
Health
http://pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onion/partners.html Down
Activity (interactive) 308
Activity charts
Posts308
Date Title Description Screen
<i class="icon-chevron-right"
CHR Solutions
The Skinners Kent Academy
Kent County Council
Rusty Hardin & Associates
R.E. Pedrotti Co.
UEMOA
Skatetown
CHRYSO
itimCloud
Bayonet
Fly Arik Air
Las Vegas Cancer Center
CarpenterProjects
Westmont Helena
Woodchurch High School
Emkay Food Sales
Premier Energy
Schmincke Künstlerfarben
Stratford Land
Dr Schneider
Rockbridge and Bath County
Nordic Pharma
The Leschaco Group
Eason Horticultural Resources
ΤΕΧΝΟΛΟΓΙΚΟ ΠΑΝΕΠΙΣΤΗΜΙΟ ΚΥΠΡΟΥ
SWL
Lucton School
Hickory Veterinary Hospital
Westvale Primary School
Property Damage Restoration
Garner Dental Group
MVS Mailers
EHS
Comstock Johnson Architects
La Bodega
Gulfport MS
Pitts Baptist Church
Emi Jay
Niemi Bil i Luleå
Department of Justice and Constitutional Development
MPRL E&P
Capitol Beauty School
Bryant Industrial Services
Alternatives, Inc.
Family Dental Health
Community Brands
Vision Source
AECOM
Jalasoft
Astera Software
Thunderbird Adventist Academy
Raj Transport Inc.
Metaenergia
Florida Heart Associates
Family Dentist Newbury
ProActive Works
Diputación de Segovia
City of Bridgeport, WV
Ferrara
Universitat Autònoma de Barcelona
Höerskool Labori Paarl
Cenikor
Suntide Commercial Realty
Motor Appliance Corporation
Townley Grammar School
Ruskin Community High School
Weiss Properties
Lesk Engineering
Our Lady's Abingdon
Western Urethane
QPharma
Price Davis LLC
Campus Sacre Coeur Wien Gymnasium
CreateInfor
InfoSync IT Solutions
Hall Technologies Inc
Consolidated High School District 230
Santélys
Instituto Mixto de Ayuda Social
Ardagh Group
ITS, Inc.
St Benet Biscop
Jurysync
Adore Fashions
HMCC
Associated Solutions
Ocean View Nursing & Rehabilitation
Betson Enterprises
One Community Health
Jesse Engineering Co
Grupo SAN
Spartanburg & Pelham OB-GYN
Haverhill High School
Woodlake Unified
HABI
Drug Alcohol Testing
Sacschool
Liberty Linehaul
Faic
Diamond Box
Allard
Fincamex
Matthews
Oliviers
Poliview
Famisanar
Saludladera
Pjfitzpatrick
CDPO
Aebel
HAC
Ribasalvarez
Noorulislam
Grupocif
Cretsenbelledonne
Groupe Lefebvre M.R.P.
The Masonic Home of Florida
Q3 Academy
Piedmont Orthopedics | OrthoAtlanta
MCLINC
WHSE
John Hardy
Marseille Provence
Alliance Building Services
Wichita Sheet Metal
Illinois Valley Community College
Monty Holding Group
The Dantherm Group
The Sixth Form Bolton
Lindenwold
The CFC
Dublin
Upper Columbia Academy
The Seifert Logistics Group
Uxbridge College
Assured Imaging
Grand Homes
Nonin Medical
The Teka Group
ACE Glass
Bosley
MK Products
Myerscough College
UCEL
Tor Vergata
West Central Foodservice
Kuenne Gruppe
Irish Farmers Journals
CASES
Rafaela Alimentos
ASE Bucuresti
Heartland
Winters Independent School District
IQA
Bakers S.A. Limited
Econocom
Avelia
Mongoldford
CWF Group Inc.
Telhai
Ayuntamiento de Guadarrama
Hackney Council
Market Pioneer
Roughrider Internation Ltd.
Bruce Turner
Mendes Júnior
Affinity Education
Gemitchellco
Rontis Medical
Mirai
Tech 2000
Benchmark Family Services
Dayliff
Merchant Taylors' School
Riggins Company
St. Margaret’s Hospice Care
Bene Ficencia
Grupo Infoar
McKinney
Overlake Obstetricians & Gynecologists,PC
St. Mary School Hyde Park
Torello Moving Strategies
Max. Aarts
Mid-Florida Pathology
Serinus Energy Plc
Outwest Express LLC
King Henrys
Summit Appliance
Brickhaus
Finance Evolution
Nama Khoi Municipality
Thinkware
Brookfield Public Schools
Salesianum School
Provenza Floors
CCS
Palos Community Consolidated School District 118
DFW Communications,Inc.
The FitzWimark School
Østre Toten Kommune Voksenopplring
Blueknight Energy Partners
The Bascom
Bridgwater & Taunton College
Neenan Company
Romanoff Group
Jebco Agencies Inc.
Wisconsin Public Radio
Intecs group
Prairie View A&M University
Flamingo Horticulture
Little Elm
Peters Bosel Lawyers
Implanta Spa
Wolf Lake Industrial Center and Terminals
Tucker Oil Company Inc.
Cleveland Institute of Music
Grand Annecy Agglomeration
Doak Shirreff Lawyers
Fairfax University of America
Brain:IT
Powerblanket
Viport
Grant Supplies
Plantaciones de Plátano
Siesacloud
Syracuse New Times
Prefeitura de Balneário Camboriú
Lo Studio Bartoli & Arveda
ProSource Wholesale
American Industrial Felt & Supply, Inc
Esteyco
D.W. Haber & Son
Dallas Production
IDS Online Store
Zionsville Community Schools
Blackhawk Mining
Baldwin Wallace University
La Châtaigneraie
A Superior Towing
OnLINE FM
Ogden Golf & Country Club
BABB Security Systems
Repro X-Press
EBSU
Paysoft
Tenderloin Housing Clinic
FirstCash Inc
Florence-Darlington Technical College
Momentum Transportation
Woodholme Gastroenterology Associates
Forest City Fire Protection
Western Flyer Express
City of Covington Louisiana
Bridgeway Inc
Transam Carriers
Dale Operating Company
Levante UD
Upstate Home Care
Modern Data Systems
Immanuel Lutheran Church and School
Millersville University
Marlboro Pediatric Dentistry​
Public Restroom Company
Grover Corparation
Aireko
Legacy Housing Corporation
Wiener Laboratorios
Eagle Eye Produce
Ciruli Brothers
JVSmith Companies
Home Grown Grocery Food Supermarket
Gering Public Schools
Affton School District
Worldwide Oilfield Machine
Divorce Lawyer in Reading & Douglassville, PA
Drug Alcohol Testing and Screening Compliance in Texas
Dayton Door Sales
Children's Network of Southwest Florida
Zamora
ATC Transportation
Commack Fire Department
Zane State College
AFP Elevator
Alliance Architecture
Aztec Events
Buffalo Schools
St Bede's College
Hyper Microsystems
Geotechnical Consultants Inc.
Cyclone Steel
OHL Judlau
The Fashion Group International
Upstate HomeCare
Vermont Personal Injury Lawyers
Sarmad Steel
Bulley
the NET - Northeast Tennessee Media Group
Famous Supply
LJ Hooker Aspley
WPSD Local 6
Karavan Trailers
Logansport Community School Corporation
FCS Financial
Danko Emergency Equipment
HVAC Facility & Plant Maintenance Tools
HPW
My Cloud Star
Note