Samas-SamsamMalware
- mikoponi.exe
- rikirafael.exe
- Samas
- SamSam
- samsam ransomware
- samsam.exe
- showmehowto.exe
Ransomware Targeted attacks -Jexboss -PSExec -HyenaFrom MISP Galaxy
Last reported 13 months ago, by GreyNoise2 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1110Brute Force
“This is enumeration: confirming accounts on exposed systems so later credential stuffing, password spraying, or brute force has a much higher chance of success.”
- T1110.003Password Spraying
“This is enumeration: confirming accounts on exposed systems so later credential stuffing, password spraying, or brute force has a much higher chance of success.”
- T1110.004Credential Stuffing
“This is enumeration: confirming accounts on exposed systems so later credential stuffing, password spraying, or brute force has a much higher chance of success.”
What the reports say
2 reports, newest first · the exact sentence from each-
Nearly 2,000 Malicious IPs Probe Microsoft Remote Desktop After Single-Day Surge“Ransomware — SamSam’s RDP initial access: U.S.”
-
Threat Advisory: Hackers Are Selling Access to MSPs“In the spring of 2016, the group responsible for deploying the Samas ransomware was observed using the same exploit to gain access to multiple organizations—and following similar timing across those organizations regarding establishing a foothold, reconnaissance, identification o…”
Thanks — we review every report.