SYMBOLCOMMON_NAMEaka. SYNONYMS
win.mespinoza (Back to overview)

Mespinoza

aka: pysa
VTCollection    

Mespinosa is a ransomware which encrypts file using an asymmetric encryption and adds .pysa as file extension. According to dissectingmalware the extension "pysa" is probably derived from the Zanzibari Coin with the same name.

References
2022-06-23 ⋅ Kaspersky ⋅ Danila Nasonov, Natalya Shornikova, Nikita Nazarov, Vasily Davydov, Vladislav Burtsev
The hateful eight: Kaspersky’s guide to modern ransomware groups’ TTPs (Download Form)
BlackByte BlackCat Clop Conti Hive LockBit Mespinoza RagnarLocker
2022-06-23 ⋅ Kaspersky ⋅ Danila Nasonov, Natalya Shornikova, Nikita Nazarov, Vasily Davydov, Vladislav Burtsev
The hateful eight: Kaspersky’s guide to modern ransomware groups’ TTPs
Conti Hive BlackByte BlackCat Clop LockBit Mespinoza Ragnarok
2022-04-18 ⋅ SentinelOne ⋅ James Haughom
From the Front Lines | Peering into A PYSA Ransomware Attack
Chisel Chisel Cobalt Strike Mespinoza
2022-04-14 ⋅ PRODAFT Threat Intelligence ⋅ PRODAFT
PYSA (Mespinoza) In-Depth Analysis
Mespinoza
2022-04-13 ⋅ PRODAFT Threat Intelligence ⋅ PRODAFT
[PYSA] Ransomware Group In-Depth Analysis
Mespinoza
2022-03-23 ⋅ splunk ⋅ Shannon Davis
Gone in 52 Seconds…and 42 Minutes: A Comparative Analysis of Ransomware Encryption Speed
Avaddon Babuk BlackMatter Conti DarkSide LockBit Maze Mespinoza REvil Ryuk
2022-03-16 ⋅ Symantec ⋅ Symantec Threat Hunter Team
The Ransomware Threat Landscape: What to Expect in 2022
AvosLocker BlackCat BlackMatter Conti DarkSide DoppelPaymer Emotet Hive Karma Mespinoza Nemty Squirrelwaffle VegaLocker WastedLocker Yanluowang Zeppelin
2022-02-23 ⋅ splunk ⋅ Shannon Davis, SURGe
An Empirically Comparative Analysis of Ransomware Binaries
Avaddon Babuk BlackMatter Conti DarkSide LockBit Maze Mespinoza REvil Ryuk
2022-01-06 ⋅ Health Sector Cybersecurity Coordination Center (HC3) ⋅ Health Sector Cybersecurity Coordination Center (HC3)
Mespinoza/GoldBurlap/CYBORG SPIDER
Mespinoza GOLD BURLAP
2021-11-29 ⋅ cyble ⋅ Cyble
Pysa Ransomware Under the Lens: A Deep-Dive Analysis
Mespinoza
2021-11-05 ⋅ Twitter (@inversecos) ⋅ inversecos
TTPs used by Pysa Ransonmware group
Mespinoza MimiKatz
2021-09-27 ⋅ Cybereason ⋅ Aleksandar Milenkoski
Threat Analysis Report: Inside the Destructive PYSA Ransomware
Mespinoza
2021-09-09 ⋅ Lacework Labs ⋅ Lacework Labs
PYSA Ransomware Gang adds Linux Support
Mespinoza
2021-08-24 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Ransomware gang's script shows exactly the files they're after
Mespinoza
2021-07-15 ⋅ Palo Alto Networks Unit 42 ⋅ Alex Hinchliffe, Quinn Cooke, Robert Falcone
Mespinoza Ransomware Gang Calls Victims “Partners,” Attacks with Gasket, "MagicSocks" Tools
Gasket Mespinoza
2021-06-23 ⋅ Blackberry ⋅ BlackBerry Research and Intelligence team
PYSA Loves ChaChi: a New GoLang RAT
ChaChi Mespinoza
2021-05-10 ⋅ DarkTracer ⋅ DarkTracer
Intelligence Report on Ransomware Gangs on the DarkWeb: List of victim organizations attacked by ransomware gangs released on the DarkWeb
RansomEXX Avaddon Babuk Clop Conti Cuba DarkSide DoppelPaymer Egregor Hades LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker Nefilim Nemty Pay2Key PwndLocker RagnarLocker Ragnarok RansomEXX REvil Sekhmet SunCrypt ThunderX
2021-05-06 ⋅ Cyborg Security ⋅ Brandon Denker
Ransomware: Hunting for Inhibiting System Backup or Recovery
Avaddon Conti DarkSide LockBit Mailto Maze Mespinoza Nemty PwndLocker RagnarLocker RansomEXX REvil Ryuk Snatch ThunderX
2021-04-25 ⋅ Vulnerability.ch Blog ⋅ Corsin Camichel
Ransomware and Data Leak Site Publication Time Analysis
Avaddon Babuk Clop Conti DarkSide DoppelPaymer Mespinoza Nefilim REvil
2021-03-16 ⋅ FBI ⋅ FBI
Alert Number CP-000142-MW: Increase in PYSA Ransomware Targeting Education Institutions
Mespinoza
2021-02-23 ⋅ CrowdStrike ⋅ CrowdStrike
2021 Global Threat Report
RansomEXX Amadey Anchor Avaddon BazarBackdoor Clop Cobalt Strike Conti Cutwail DanaBot DarkSide DoppelPaymer Dridex Egregor Emotet Hakbit IcedID JSOutProx KerrDown LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker NedDnLoader Nemty Pay2Key PlugX Pushdo PwndLocker PyXie QakBot Quasar RAT RagnarLocker Ragnarok RansomEXX REvil Ryuk Sekhmet ShadowPad SmokeLoader Snake SUNBURST SunCrypt TEARDROP TrickBot WastedLocker Winnti Zloader Evilnum OUTLAW SPIDER RIDDLE SPIDER SOLAR SPIDER VIKING SPIDER
2021-01-07 ⋅ Twitter (@campuscodi) ⋅ Catalin Cimpanu
Tweet on London's Hackney Council attacked by Pysa/Mespinoza ransomware
Mespinoza
2021-01-01 ⋅ Secureworks ⋅ SecureWorks
Threat Profile: GOLD BURLAP
Empire Downloader Mespinoza MimiKatz GOLD BURLAP
2020-11-23 ⋅ The DFIR Report ⋅ The DFIR Report
PYSA/Mespinoza Ransomware
Empire Downloader Mespinoza
2020-11-16 ⋅ Intel 471 ⋅ Intel 471
Ransomware-as-a-service: The pandemic within a pandemic
Avaddon Clop Conti DoppelPaymer Egregor Hakbit Mailto Maze Mespinoza RagnarLocker REvil Ryuk SunCrypt ThunderX
2020-10-23 ⋅ Hornetsecurity ⋅ Hornetsecurity Security Lab
Leakware-Ransomware-Hybrid Attacks
Avaddon Clop Conti DarkSide DoppelPaymer Mailto Maze Mespinoza Nefilim RagnarLocker REvil Sekhmet SunCrypt
2020-08-25 ⋅ KELA ⋅ Victoria Kivilevich
How Ransomware Gangs Find New Monetization Schemes and Evolve in Marketing
Avaddon Clop DarkSide DoppelPaymer Mailto Maze MedusaLocker Mespinoza Nefilim RagnarLocker REvil Sekhmet
2020-03-31 ⋅ ANSSI ⋅ ANSSI
ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE
Mespinoza
2020-03-19 ⋅ ZDNet ⋅ Catalin Cimpanu
France warns of new ransomware gang targeting local governments
Mespinoza
2020-03-18 ⋅ ⋅ ANSSI ⋅ ANSSI
ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE
Mespinoza
2020-03-18 ⋅ ⋅ CERT-FR ⋅ CERT-FR
Rapport Menaces et Incidents du CERT-FR: Attaques par le rançongiciel Mespinoza/Pysa
Mespinoza
2019-12-14 ⋅ Dissecting Malware ⋅ Marius Genheimer
Another one for the collection - Mespinoza (Pysa) Ransomware
Mespinoza
2019-10-11 ⋅ ID Ransomware ⋅ Andrew Ivanov
Mespinoza Ransomware
Mespinoza
Yara Rules
[TLP:WHITE] win_mespinoza_auto (20260917 | Detects win.mespinoza.)
rule win_mespinoza_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.mespinoza."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mespinoza"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { ff75ec c645fc05 57 ff7518 ff75f0 53 }
            // n = 6, score = 200
            //   ff75ec               | push                dword ptr [ebp - 0x14]
            //   c645fc05             | mov                 byte ptr [ebp - 4], 5
            //   57                   | push                edi
            //   ff7518               | push                dword ptr [ebp + 0x18]
            //   ff75f0               | push                dword ptr [ebp - 0x10]
            //   53                   | push                ebx

        $sequence_1 = { c745640c000000 e8???????? 8d4d4c c745fc09000000 51 50 8d45dc }
            // n = 7, score = 200
            //   c745640c000000       | mov                 dword ptr [ebp + 0x64], 0xc
            //   e8????????           |                     
            //   8d4d4c               | lea                 ecx, [ebp + 0x4c]
            //   c745fc09000000       | mov                 dword ptr [ebp - 4], 9
            //   51                   | push                ecx
            //   50                   | push                eax
            //   8d45dc               | lea                 eax, [ebp - 0x24]

        $sequence_2 = { 3bd0 0f8c32010000 8b85bcebffff 7f08 3bc7 0f8620010000 8bbdc4ebffff }
            // n = 7, score = 200
            //   3bd0                 | cmp                 edx, eax
            //   0f8c32010000         | jl                  0x138
            //   8b85bcebffff         | mov                 eax, dword ptr [ebp - 0x1444]
            //   7f08                 | jg                  0xa
            //   3bc7                 | cmp                 eax, edi
            //   0f8620010000         | jbe                 0x126
            //   8bbdc4ebffff         | mov                 edi, dword ptr [ebp - 0x143c]

        $sequence_3 = { 0f8620010000 8bbdc4ebffff 85c9 0f88f5000000 8bc1 99 8985c4ebffff }
            // n = 7, score = 200
            //   0f8620010000         | jbe                 0x126
            //   8bbdc4ebffff         | mov                 edi, dword ptr [ebp - 0x143c]
            //   85c9                 | test                ecx, ecx
            //   0f88f5000000         | js                  0xfb
            //   8bc1                 | mov                 eax, ecx
            //   99                   | cdq                 
            //   8985c4ebffff         | mov                 dword ptr [ebp - 0x143c], eax

        $sequence_4 = { e8???????? c6451700 eb47 85d2 741f 8b07 8d4d9c }
            // n = 7, score = 200
            //   e8????????           |                     
            //   c6451700             | mov                 byte ptr [ebp + 0x17], 0
            //   eb47                 | jmp                 0x49
            //   85d2                 | test                edx, edx
            //   741f                 | je                  0x21
            //   8b07                 | mov                 eax, dword ptr [edi]
            //   8d4d9c               | lea                 ecx, [ebp - 0x64]

        $sequence_5 = { 85f6 7438 81feffffff3f 7738 57 56 e8???????? }
            // n = 7, score = 200
            //   85f6                 | test                esi, esi
            //   7438                 | je                  0x3a
            //   81feffffff3f         | cmp                 esi, 0x3fffffff
            //   7738                 | ja                  0x3a
            //   57                   | push                edi
            //   56                   | push                esi
            //   e8????????           |                     

        $sequence_6 = { 0f45c8 894dd4 3bcf 740a 807df300 7504 32d2 }
            // n = 7, score = 200
            //   0f45c8               | cmovne              ecx, eax
            //   894dd4               | mov                 dword ptr [ebp - 0x2c], ecx
            //   3bcf                 | cmp                 ecx, edi
            //   740a                 | je                  0xc
            //   807df300             | cmp                 byte ptr [ebp - 0xd], 0
            //   7504                 | jne                 6
            //   32d2                 | xor                 dl, dl

        $sequence_7 = { 8d45f4 64a300000000 8bf1 8b4d08 8d45c4 50 e8???????? }
            // n = 7, score = 200
            //   8d45f4               | lea                 eax, [ebp - 0xc]
            //   64a300000000         | mov                 dword ptr fs:[0], eax
            //   8bf1                 | mov                 esi, ecx
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]
            //   8d45c4               | lea                 eax, [ebp - 0x3c]
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_8 = { c21400 55 8bec 51 56 ff7508 8bf1 }
            // n = 7, score = 200
            //   c21400               | ret                 0x14
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   51                   | push                ecx
            //   56                   | push                esi
            //   ff7508               | push                dword ptr [ebp + 8]
            //   8bf1                 | mov                 esi, ecx

        $sequence_9 = { c745fc06000000 0f43ca 8b55f0 8bfa }
            // n = 4, score = 200
            //   c745fc06000000       | mov                 dword ptr [ebp - 4], 6
            //   0f43ca               | cmovae              ecx, edx
            //   8b55f0               | mov                 edx, dword ptr [ebp - 0x10]
            //   8bfa                 | mov                 edi, edx

    condition:
        7 of them and filesize < 1091584
}
Download all Yara Rules