Pysa

Description

Mespinosa is a ransomware which encrypts file using an asymmetric encryption and adds .pysa as file extension. According to dissectingmalware the extension "pysa" is probably derived from the Zanzibari Coin with the same name.

External Analysis
https://www.ic3.gov/Media/News/2021/210316.pdf
https://blog.malwarebytes.com/threat-spotlight/2021/03/pysa-the-ransomware-attacking-schools
http://www.secureworks.com/research/threat-profiles/gold-burlap
https://blog.cyble.com/2021/11/29/pysa-ransomware-under-the-lens-a-deep-dive-analysis/
https://blogs.blackberry.com/en/2021/06/pysa-loves-chachi-a-new-golang-rat
https://dissectingmalwa.re/another-one-for-the-collection-mespinoza-pysa-ransomware.html
https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3
https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf
https://id-ransomware.blogspot.com/2019/10/mespinoza-ransomware.html
https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf
https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/
https://securelist.com/modern-ransomware-groups-ttps/106824/
https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/
https://twitter.com/campuscodi/status/1347223969984897026
https://twitter.com/inversecos/status/1456486725664993287
https://unit42.paloaltonetworks.com/gasket-and-magicsocks-tools-install-mespinoza-ransomware/
https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/
https://www.bleepingcomputer.com/news/security/ransomware-gangs-script-shows-exactly-the-files-theyre-after/
https://www.cert.ssi.gouv.fr/cti/CERTFR-2020-CTI-002/
https://www.cybereason.com/blog/threat-analysis-report-inside-the-destructive-pysa-ransomware
https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/
https://www.hhs.gov/sites/default/files/mespinoza-goldburlap-cyborgspider-analystnote-tlpwhite.pdf
https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/
https://www.ic3.gov/Media/News/2021/210316.pdf
https://www.lacework.com/blog/pysa-ransomware-gang-adds-linux-support/
https://www.prodaft.com/m/reports/PYSA_TLPWHITE_3.0.pdf
https://www.prodaft.com/resource/detail/pysa-ransomware-group-depth-analysis
https://www.sentinelone.com/blog/from-the-front-lines-peering-into-a-pysa-ransomware-attack/
https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html
https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf
https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf
https://www.zdnet.com/article/france-warns-of-new-ransomware-gang-targeting-local-governments/
Urls
Screen
http://pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onion/partners.html
File servers
Screen
Chat servers
Screen

Posts

Date Title Description Screen
2021-12-29
<i class="icon-chevron-right"
2021-12-06
CHR Solutions
2021-11-08
The Skinners Kent Academy
2021-11-08
Kent County Council
2021-11-08
Rusty Hardin & Associates
2021-11-08
R.E. Pedrotti Co.
2021-11-08
UEMOA
2021-11-08
Skatetown
2021-11-08
CHRYSO
2021-11-08
itimCloud
2021-11-08
Bayonet
2021-11-08
Fly Arik Air
2021-11-08
Las Vegas Cancer Center
2021-11-08
CarpenterProjects
2021-11-08
Westmont Helena
2021-11-08
Woodchurch High School
2021-11-08
Emkay Food Sales
2021-11-08
Premier Energy
2021-11-08
Schmincke Künstlerfarben
2021-11-08
Stratford Land
2021-11-08
Dr Schneider
2021-11-08
Rockbridge and Bath County
2021-11-08
Nordic Pharma
2021-11-08
The Leschaco Group
2021-11-08
Eason Horticultural Resources
2021-11-08
ΤΕΧΝΟΛΟΓΙΚΟ ΠΑΝΕΠΙΣΤΗΜΙΟ ΚΥΠΡΟΥ
2021-11-08
SWL
2021-11-08
Lucton School
2021-11-08
Hickory Veterinary Hospital
2021-11-08
Westvale Primary School
2021-11-08
Property Damage Restoration
2021-11-08
Garner Dental Group
2021-11-08
MVS Mailers
2021-11-08
EHS
2021-11-08
Comstock Johnson Architects
2021-11-08
La Bodega
2021-11-08
Gulfport MS
2021-11-08
Pitts Baptist Church
2021-11-08
Emi Jay
2021-11-08
Niemi Bil i Luleå
2021-11-08
Department of Justice and Constitutional Development
2021-11-08
MPRL E&P
2021-11-08
Capitol Beauty School
2021-11-08
Bryant Industrial Services
2021-11-08
Alternatives, Inc.
2021-11-08
Family Dental Health
2021-11-08
Community Brands
2021-11-08
Vision Source
2021-11-08
AECOM
2021-11-08
Jalasoft
2021-11-08
Astera Software
2021-11-08
Thunderbird Adventist Academy
2021-11-08
Raj Transport Inc.
2021-11-08
Metaenergia
2021-11-08
Florida Heart Associates
2021-11-08
Family Dentist Newbury
2021-11-08
ProActive Works
2021-11-08
Diputación de Segovia
2021-11-08
City of Bridgeport, WV
2021-11-08
Ferrara
2021-11-08
Universitat Autònoma de Barcelona
2021-10-25
Höerskool Labori Paarl
2021-10-25
Cenikor
2021-10-25
Suntide Commercial Realty
2021-10-25
Motor Appliance Corporation
2021-10-22
Townley Grammar School
2021-10-22
Ruskin Community High School
2021-10-22
Weiss Properties
2021-10-18
Lesk Engineering
2021-10-18
Our Lady's Abingdon
2021-10-18
Western Urethane
2021-10-18
QPharma
2021-10-18
Price Davis LLC
2021-10-18
Campus Sacre Coeur Wien Gymnasium
2021-10-18
CreateInfor
2021-10-18
InfoSync IT Solutions
2021-10-18
Hall Technologies Inc
2021-10-04
Consolidated High School District 230
2021-10-04
Santélys
2021-10-04
Instituto Mixto de Ayuda Social
2021-10-04
Ardagh Group
2021-10-04
ITS, Inc.
2021-10-04
St Benet Biscop
2021-10-04
Jurysync
2021-10-04
Adore Fashions
2021-10-04
HMCC
2021-10-04
Associated Solutions
2021-10-04
Ocean View Nursing & Rehabilitation
2021-09-13
Betson Enterprises
2021-09-13
One Community Health
2021-09-13
Jesse Engineering Co
2021-09-13
Grupo SAN
2021-09-13
Spartanburg & Pelham OB-GYN
2021-09-13
Haverhill High School
2021-09-13
Woodlake Unified
2021-09-13
HABI
2021-09-10
Drug Alcohol Testing
2021-09-09
Sacschool
2021-09-09
Liberty Linehaul
2021-09-09
Faic
2021-09-09
Diamond Box
2021-09-09
Allard
2021-09-09
Fincamex
2021-09-09
Matthews
2021-09-09
Oliviers
2021-09-09
Poliview
2021-09-09
Famisanar
2021-09-09
Saludladera
2021-09-09
Pjfitzpatrick
2021-09-09
CDPO
2021-09-09
Aebel
2021-09-09
HAC
2021-09-09
Ribasalvarez
2021-09-09
Noorulislam
2021-09-09
Grupocif
2021-09-09
Cretsenbelledonne
2021-09-09
Groupe Lefebvre M.R.P.
2021-09-09
The Masonic Home of Florida
2021-09-09
Q3 Academy
2021-09-09
Piedmont Orthopedics | OrthoAtlanta
2021-09-09
MCLINC
2021-09-09
WHSE
2021-09-09
John Hardy
2021-09-09
Marseille Provence
2021-09-09
Alliance Building Services
2021-09-09
Wichita Sheet Metal
2021-09-09
Illinois Valley Community College
2021-09-09
Monty Holding Group
2021-09-09
The Dantherm Group
2021-09-09
The Sixth Form Bolton
2021-09-09
Lindenwold
2021-09-09
The CFC
2021-09-09
Dublin
2021-09-09
Upper Columbia Academy
2021-09-09
The Seifert Logistics Group
2021-09-09
Uxbridge College
2021-09-09
Assured Imaging
2021-09-09
Grand Homes
2021-09-09
Nonin Medical
2021-09-09
The Teka Group
2021-09-09
ACE Glass
2021-09-09
Bosley
2021-09-09
MK Products
2021-09-09
Myerscough College
2021-09-09
UCEL
2021-09-09
Tor Vergata
2021-09-09
West Central Foodservice
2021-09-09
Kuenne Gruppe
2021-09-09
Irish Farmers Journals
2021-09-09
CASES
2021-09-09
Rafaela Alimentos
2021-09-09
ASE Bucuresti
2021-09-09
Heartland
2021-09-09
Winters Independent School District
2021-09-09
IQA
2021-09-09
Bakers S.A. Limited
2021-09-09
Econocom
2021-09-09
Avelia
2021-09-09
Mongoldford
2021-09-09
CWF Group Inc.
2021-09-09
Telhai
2021-09-09
Ayuntamiento de Guadarrama
2021-09-09
Hackney Council
2021-09-09
Market Pioneer
2021-09-09
Roughrider Internation Ltd.
2021-09-09
Bruce Turner
2021-09-09
Mendes Júnior
2021-09-09
Affinity Education
2021-09-09
Gemitchellco
2021-09-09
Rontis Medical
2021-09-09
Mirai
2021-09-09
Tech 2000
2021-09-09
Benchmark Family Services
2021-09-09
Dayliff
2021-09-09
Merchant Taylors' School
2021-09-09
Riggins Company
2021-09-09
St. Margaret’s Hospice Care
2021-09-09
Bene Ficencia
2021-09-09
Grupo Infoar
2021-09-09
McKinney
2021-09-09
Overlake Obstetricians & Gynecologists,PC
2021-09-09
St. Mary School Hyde Park
2021-09-09
Torello Moving Strategies
2021-09-09
Max. Aarts
2021-09-09
Mid-Florida Pathology
2021-09-09
Serinus Energy Plc
2021-09-09
Outwest Express LLC
2021-09-09
King Henrys
2021-09-09
Summit Appliance
2021-09-09
Brickhaus
2021-09-09
Finance Evolution
2021-09-09
Nama Khoi Municipality
2021-09-09
Thinkware
2021-09-09
Brookfield Public Schools
2021-09-09
Salesianum School
2021-09-09
Provenza Floors
2021-09-09
CCS
2021-09-09
Palos Community Consolidated School District 118
2021-09-09
DFW Communications,Inc.
2021-09-09
The FitzWimark School
2021-09-09
Østre Toten Kommune Voksenopplring
2021-09-09
Blueknight Energy Partners
2021-09-09
The Bascom
2021-09-09
Bridgwater & Taunton College
2021-09-09
Neenan Company
2021-09-09
Romanoff Group
2021-09-09
Jebco Agencies Inc.
2021-09-09
Wisconsin Public Radio
2021-09-09
Intecs group
2021-09-09
Prairie View A&M University
2021-09-09
Flamingo Horticulture
2021-09-09
Little Elm
2021-09-09
Peters Bosel Lawyers
2021-09-09
Implanta Spa
2021-09-09
Wolf Lake Industrial Center and Terminals
2021-09-09
Tucker Oil Company Inc.
2021-09-09
Cleveland Institute of Music
2021-09-09
Grand Annecy Agglomeration
2021-09-09
Doak Shirreff Lawyers
2021-09-09
Fairfax University of America
2021-09-09
Brain:IT
2021-09-09
Powerblanket
2021-09-09
Viport
2021-09-09
Grant Supplies
2021-09-09
Plantaciones de Plátano
2021-09-09
Siesacloud
2021-09-09
Syracuse New Times
2021-09-09
Prefeitura de Balneário Camboriú
2021-09-09
Lo Studio Bartoli & Arveda
2021-09-09
ProSource Wholesale
2021-09-09
American Industrial Felt & Supply, Inc
2021-09-09
Esteyco
2021-09-09
D.W. Haber & Son
2021-09-09
Dallas Production
2021-09-09
IDS Online Store
2021-09-09
Zionsville Community Schools
2021-09-09
Blackhawk Mining
2021-09-09
Baldwin Wallace University
2021-09-09
La Châtaigneraie
2021-09-09
A Superior Towing
2021-09-09
OnLINE FM
2021-09-09
Ogden Golf & Country Club
2021-09-09
BABB Security Systems
2021-09-09
Repro X-Press
2021-09-09
EBSU
2021-09-09
Paysoft
2021-09-09
Tenderloin Housing Clinic
2021-09-09
FirstCash Inc
2021-09-09
Florence-Darlington Technical College
2021-09-09
Momentum Transportation
2021-09-09
Woodholme Gastroenterology Associates
2021-09-09
Forest City Fire Protection
2021-09-09
Western Flyer Express
2021-09-09
City of Covington Louisiana
2021-09-09
Bridgeway Inc
2021-09-09
Transam Carriers
2021-09-09
Dale Operating Company
2021-09-09
Levante UD
2021-09-09
Upstate Home Care
2021-09-09
Modern Data Systems
2021-09-09
Immanuel Lutheran Church and School
2021-09-09
Millersville University
2021-09-09
Marlboro Pediatric Dentistry​
2021-09-09
Public Restroom Company
2021-09-09
Grover Corparation
2021-09-09
Aireko
2021-09-09
Legacy Housing Corporation
2021-09-09
Wiener Laboratorios
2021-09-09
Eagle Eye Produce
2021-09-09
Ciruli Brothers
2021-09-09
JVSmith Companies
2021-09-09
Home Grown Grocery Food Supermarket
2021-09-09
Gering Public Schools
2021-09-09
Affton School District
2021-09-09
Worldwide Oilfield Machine
2021-09-09
Divorce Lawyer in Reading & Douglassville, PA
2021-09-09
Drug Alcohol Testing and Screening Compliance in Texas
2021-09-09
Dayton Door Sales
2021-09-09
Children's Network of Southwest Florida
2021-09-09
Zamora
2021-09-09
ATC Transportation
2021-09-09
Commack Fire Department
2021-09-09
Zane State College
2021-09-09
AFP Elevator
2021-09-09
Alliance Architecture
2021-09-09
Aztec Events
2021-09-09
Buffalo Schools
2021-09-09
St Bede's College
2021-09-09
Hyper Microsystems
2021-09-09
Geotechnical Consultants Inc.
2021-09-09
Cyclone Steel
2021-09-09
OHL Judlau
2021-09-09
The Fashion Group International
2021-09-09
Upstate HomeCare
2021-09-09
Vermont Personal Injury Lawyers
2021-09-09
Sarmad Steel
2021-09-09
Bulley
2021-09-09
the NET - Northeast Tennessee Media Group
2021-09-09
Famous Supply
2021-09-09
LJ Hooker Aspley
2021-09-09
WPSD Local 6
2021-09-09
Karavan Trailers
2021-09-09
Logansport Community School Corporation
2021-09-09
FCS Financial
2021-09-09
Danko Emergency Equipment
2021-09-09
HVAC Facility & Plant Maintenance Tools
2021-09-09
HPW
2021-09-09
My Cloud Star