Another one for the collection - Mespinoza (Pysa) Ransomware

Fun Fact: The Extension "pysa" is probably derived from the Zanzibari Coin with the same name. Apparently it's quite popular with collectors. But enough of the pocket change, so let me put my two cents in on this sample :D


A general disclaimer as always: downloading and running the samples linked below will lead to the encryption of your personal data, so be f$cking careful. Also check with your local laws as owning malware binaries/ sources might be illegal depending on where you live.

Mespinoza (.pysa) @ AnyRun | VirusTotal | HybridAnalysis --> sha256 a18c85399cd1ec3f1ec85cd66ff2e97a0dcf7ccb17ecf697a5376da8eda4d327

As always: Running Detect it easy on the executable:


One of the first things it will do is modify the SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Registry Key to set the following values. Unfortunately I couldn't confirm this action in a sandbox with RegShot yet.

Anti Debugging

To retain basic functions of the Operating System Mespinoza will spare certain directories related directly to Windows and critical files.

It will also specifically look for SQL related processes. I will have to confirm this with a debugger, but most of the time database processes are killed by Ransomware to disrupt the service and make the files available for encryption.

Looking for SQL related strings

Of course Mespinoza won't stop with the system drive so it will check for connected removable media or shared network drives. GetDriveTypeW will tell it which type of media the selected device belongs to.

Checking for system drives Determining the drive type

Up until now I have not seen a ransomware sample running verclsid.exe, so let's investigate: {0B2C9183-C9FA-4C53-AE21-C900B0C39965} corresponds to C:\Windows\system32\SearchFolder.dll and {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} matches the CLSID of IDBProperties which is part of the Microsoft SQL Server.

C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401

After looking at a string dump I found this hex string which is probably the key blob. I'll try to verify this with x32dbg later.


Turns out that the encrypted key is appended to the end of each file affected by the ransomware (which is a common tactic for some strains).

Appended and encrypted key

As this article is work in progress I will update it as soon as I can. As I did not see the Malware deleting the Volume Shadow Copies until now, so one option for possible victims would be to run Photorec or Recuva to check for recoverable files.


T1215 --> Kernel Modules and Extensions --> Persistence

T1045 --> Software Packing --> Defense Evasion

T1012 --> Query Registry --> Discovery

T1114 --> Email Collection --> Collection


Mespinoza (pysa)

1.exe --> SHA256: a18c85399cd1ec3f1ec85cd66ff2e97a0dcf7ccb17ecf697a5376da8eda4d327
          SSDEEP: 12288:aVchT6oi+OeO+OeNhBBhhBBpiOTn5CjGGc4dXOsOjKf:aVc1Jiin5yGpMIj

File size: 504.50 KB

Associated Files


E-Mail Addresses

[email protected][.]com
[email protected][.]com

Used in previous campaigns:

[email protected][.]com
[email protected][.]com
[email protected][.]com


Hi Company,

Every byte on any types of your devices was encrypted.
Don’t try to use backups because it were encrypted too.

To get all your data back contact us:
[email protected]
[email protected]


  1. Q: How can I make sure you don’t fooling me?
    A: You can send us 2 files(max 2mb).

  2. Q: What to do to get all data back?
    A: Don’t restart the computer, don’t move files and write us.

  3. Q: What to tell my boss?
    A: Protect Your System Amigo.

Article Link: