Samsam

Overview

Ransom:Win32/SamSam (also known as Samas) is a highly destructive, **Targeted Ransomware** family that gained infamy for crippling hospitals, municipalities, and large enterprises (most notably the City of Atlanta in 2018). Unlike traditional 'spray-and-pray' ransomware spread via mass phishing, SamSam is characterized by its *manual deployment*. Attackers breach the network, map the infrastructure, and deliberately execute the encryptor for maximum extortion impact.

Understanding SamSam (Targeted Ransomware)
To an end-user, the impact is catastrophic: servers and workstations are suddenly encrypted, appended with the `.weapologize` extension (or similar), and a ransom note (`PLEASE_READ_FOR_DECRYPT.txt`) demands massive cryptocurrency payments. For an incident response team, a SamSam infection means a human adversary has been actively roaming the network for days or weeks, escalating privileges and intentionally disabling backups before launching the final payload.

Execution and Manual Deployment Mechanics
The initial attack vector is almost never an email. Attackers typically exploit vulnerable, public-facing infrastructure, most commonly brute-forcing or exploiting unpatched Remote Desktop Protocol (RDP) servers or vulnerable JBoss application servers (`T1190`, `T1133`). Once inside, they use legitimate tools (like Mimikatz and PsExec) to harvest domain admin credentials (`T1003.001`) and move laterally (`T1569.002`). The attackers then manually copy the SamSam encryptor binary to critical servers and workstations. They often use batch scripts to systematically delete Volume Shadow Copies (`vssadmin.exe delete shadows`) (`T1490`) and then manually execute the SamSam payload using an RSA-2048/AES-256 hybrid encryption scheme (`T1486`).

Indicators of Compromise & Impact
The impact is total operational paralysis and severe financial loss. Host-based IoCs include the presence of the SamSam executable (often named `sysname.exe` or `svchost.exe` running from odd locations), the execution of `vssadmin` or `bcdedit` commands just prior to encryption, and the specific `.weapologize` or `.samsam` file extensions. Network IoCs include a massive spike in internal RDP traffic and SMB file transfers (PsExec) leading up to the event, as the attacker manually distributes the payload.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_SAMSAM {
    meta:
        description = "Detects Samsam (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "samsam" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Samsam Activity
id: eadd934e2cc978fc622fc1324878d8af
status: experimental
description: Detects generic indicators of the samsam malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*samsam*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. IMMEDIATELY isolate all affected subnets and shut down any exposed RDP gateways to prevent further lateral movement by the active human adversary.
2. Do not assume the attack is over once encryption starts; the attackers may still have persistence via backdoors or compromised domain admin accounts.
3. Identify the initial entry point (e.g., exposed RDP on a specific server) and patch/secure it before attempting restoration.
4. Restore systems from offline, immutable backups; SamSam attackers deliberately target and encrypt connected backup servers.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not treat a SamSam infection as an automated virus event; you must hunt for the active attacker's persistence mechanisms and compromised accounts.
2. Avoid paying the ransom; SamSam operators have occasionally failed to provide working decryptors even after payment.

References & External Analysis

• Search "samsam" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Tipp
• Zombam
• Etap
• Samca
• Effbee

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/samsam.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.