Samsam

Overview

Ransom:Win32/SamSam (also known as Samas) is a highly destructive, **Targeted Ransomware** family that gained infamy for crippling hospitals, municipalities, and large enterprises (most notably the City of Atlanta in 2018). Unlike traditional 'spray-and-pray' ransomware spread via mass phishing, SamSam is characterized by its *manual deployment*. Attackers breach the network, map the infrastructure, and deliberately execute the encryptor for maximum extortion impact.

Understanding SamSam (Targeted Ransomware)
To an end-user, the impact is catastrophic: servers and workstations are suddenly encrypted, appended with the `.weapologize` extension (or similar), and a ransom note (`PLEASE_READ_FOR_DECRYPT.txt`) demands massive cryptocurrency payments. For an incident response team, a SamSam infection means a human adversary has been actively roaming the network for days or weeks, escalating privileges and intentionally disabling backups before launching the final payload.

Execution and Manual Deployment Mechanics
The initial attack vector is almost never an email. Attackers typically exploit vulnerable, public-facing infrastructure, most commonly brute-forcing or exploiting unpatched Remote Desktop Protocol (RDP) servers or vulnerable JBoss application servers (`T1190`, `T1133`). Once inside, they use legitimate tools (like Mimikatz and PsExec) to harvest domain admin credentials (`T1003.001`) and move laterally (`T1569.002`). The attackers then manually copy the SamSam encryptor binary to critical servers and workstations. They often use batch scripts to systematically delete Volume Shadow Copies (`vssadmin.exe delete shadows`) (`T1490`) and then manually execute the SamSam payload using an RSA-2048/AES-256 hybrid encryption scheme (`T1486`).

Indicators of Compromise & Impact
The impact is total operational paralysis and severe financial loss. Host-based IoCs include the presence of the SamSam executable (often named `sysname.exe` or `svchost.exe` running from odd locations), the execution of `vssadmin` or `bcdedit` commands just prior to encryption, and the specific `.weapologize` or `.samsam` file extensions. Network IoCs include a massive spike in internal RDP traffic and SMB file transfers (PsExec) leading up to the event, as the attacker manually distributes the payload.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_SAMSAM_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Samsam"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "samsam" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Samsam (Ransomware) Execution & Triage
id: 58dfa50c-f873-512b-af82-a6c0eb214f52
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Samsam malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/samsam
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1133
- attack.t1486
- attack.t1490
- attack.t1569_002
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_SAMSAM_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Samsam tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "samsam" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. IMMEDIATELY isolate all affected subnets and shut down any exposed RDP gateways to prevent further lateral movement by the active human adversary.
2. Do not assume the attack is over once encryption starts; the attackers may still have persistence via backdoors or compromised domain admin accounts.
3. Identify the initial entry point (e.g., exposed RDP on a specific server) and patch/secure it before attempting restoration.
4. Restore systems from offline, immutable backups; SamSam attackers deliberately target and encrypt connected backup servers.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not treat a SamSam infection as an automated virus event; you must hunt for the active attacker's persistence mechanisms and compromised accounts.
2. Avoid paying the ransom; SamSam operators have occasionally failed to provide working decryptors even after payment.

References & External Analysis

• Search "samsam" on VirusTotal (External Analysis)
• Search "samsam" on Any.Run (Sandbox Sandbox)
• Search "samsam" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Nagoot
• Phires
• Higuniel
• Dorv
• Xundlldl
• Winload
• Kryptyk
• Kbot

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/samsam.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.