Samsam

How Samsam typically operates, as attributed by MITRE ATT&CK v19.2. Attributed via SamSam.

1. T1059.003 Windows Command Shell Execution

   What they do: SamSam uses custom batch scripts to execute some of its components.

   What that means: Adversaries may abuse the Windows command shell for execution.

2. T1027.013 Encrypted/Encoded File Stealth

   What they do: SamSam has been seen using AES or DES to encrypt payloads and payload components.

   What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.

3. T1027.016 Junk Code Insertion Stealth

   What they do: SamSam has used garbage code to pad some of its malware components.

   What that means: Adversaries may use junk code / dead code to obfuscate a malware’s functionality.

4. T1070.004 File Deletion Stealth

   What they do: SamSam has been seen deleting its own files and payloads to make analysis of the attack more difficult.

   What that means: Adversaries may delete files left behind by the actions of their intrusion activity.

5. T1486 Data Encrypted for Impact Impact

   What they do: SamSam encrypts victim files using RSA-2048 encryption and demands a ransom be paid in Bitcoin to decrypt those files.

   What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

+36 more wallets not shown (the 12 largest by amount received are listed).

Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122