SamuraiMalware
Samurai is a passive backdoor that has been used by ToddyCat since at least 2020. Samurai allows arbitrary C# code execution and is used with multiple modules for remote administration and lateral movement.From MITRE ATT&CK
Last reported 4 months ago, by Sekoia.io1 report
ATT&CK techniques
1 technique · each with the sentence it comes from- T1684Social Engineering
“By May 20241, ClecarFake adopted the new social engineering tactic ClickFix, displaying fake error messages in the web browser and deceiving users into copying and executing a given malicious PowerShell code that finally infected their systems.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
ClearFake's Variant: Web3 Exploitation for Malware Delivery“console.error(`Samurai lost at temple ${templeNumber}:`, samuraiError);”
Indicators in its reports
named in the reports above- hxxps://start.cleaning-room-device[.]shop/sha589.m4ain 1 report
- start.cleaning-room-device[.]shopin 1 report
- hxxps://ai.fdswgw[.]shop/one.mp4in 1 report
- ai.fdswgw[.]shopin 1 report
- hxxps://mnjk-jk.bsdfg-zmp-q-n[.]shop/1.mp4in 1 report
- mnjk-jk.bsdfg-zmp-q-n[.]shopin 1 report
- hxxps://nbhg-v.iuksdfb-f[.]shop/ajax.mp3in 1 report
- nbhg-v.iuksdfb-f[.]shopin 1 report
- hxxps://hur.bweqlkjr[.]shop/m41.mp4in 1 report
- hur.bweqlkjr[.]shopin 1 report
- hbwzfr[.]runin 1 report
- 6d6c646e664c595246466a4a64464a51in 1 report
- hxxps://ty.klipxytozyi[.]shop/kangarooing.bmpin 1 report
- ty.klipxytozyi[.]shopin 1 report
- hxxps://raw.githubusercontent[.]com/Vincent-48/html/refs/heads/master/page.txtin 1 report
- hxxps://raw.githubusercontent[.]com/Vincent-48/html/refs/heads/master/TestLAB.exein 1 report
- hxxps://lapkimeow[.]icu/runin 1 report
- lapkimeow[.]icuin 1 report
- ert67-o9.pages[.]devin 1 report
- hxxps://f003.backblazeb2[.]com/file/skippp/uu.htmlin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.