Pysa
Mespinosa is a ransomware which encrypts file using an asymmetric encryption and adds .pysa as file extension. According to dissectingmalware the extension "pysa" is probably derived from the Zanzibari Coin with the same name.
Victims
309
First Discovered
2020-07-01
victim
Last Discovered
2022-09-20
victim
Inactive Since
3yrs
more than
Avg Delay
N/A
attack→claim
Infostealer
66.7%
victims with domain
Countries
4
hit
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
Pysa's Partners | No | 2026-04-28T07:25:48 |
pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onion
|
Target
Top 5 Activity Sectors
- Education 50
- Business Services 38
- Healthcare 32
- Manufacturing 29
- Transportation/Logistics 17
Top 5 Countries
-
Canada
2
-
France
1
-
United Kingdom
1
-
United States
1
Heatmap
Tools Used
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
|---|---|---|---|---|---|---|---|
|
ADRecon
Advanced IP Scanner
Advanced Port Scanner
|
|
|
Mimikatz
ProcDump
SessionGopher
|
Chashell
Koadic
PowerShell Empire
PowerSploit
|
|
PsExec
WMIC
|
FileZilla
WinSCP
|
YARA Rules (1)
Victims (309)
