SamSam

MITRE ATT&CK: S0370 View on attack.mitre.org

Aliases: Samas, samsam.exe, MIKOPONI.exe, RikiRafael.exe, showmehowto.exe, SamSam Ransomware, SamSam, Samsam

First seen
2016-01-01 00:00:00
Malware type
ransomware
Family
Malware family
Operating systems
windows
Related IoCs
13 (1 malicious)
Last IoC activity
2026-10-16 17:44:09
Profile updated
2026-07-07 15:43:06

Targeted industries: healthcare-and-pharmaceutical government-and-public-sector education-and-nonprofits

Context

SamSam is ransomware that appeared in early 2016. Unlike some ransomware, its variants have required operators to manually interact with the malware to execute some of its core components.

Recent IoC activity

1 malicious indicator in Maltiverse are attributed to SamSam (S0370). The 1 most recently updated:

TypeIndicatorUpdatedSources
file sample ee5dbfca30be494b6ad8ac1c18255b6054339de4aba768180a1f32e9921a30ce 2026-09-15 2

Detection coverage

  • 50 Sigma rules

Malware & tools used

  • File Deletion (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Junk Code Insertion (attack-pattern)
  • Data Encrypted for Impact (attack-pattern)

Related threat objects

Reports & references

  • CrowdStrike — Double Trouble Ransomware Data Leak Extortion Part 1 (report)
  • Microsoft — Human Operated Ransomware Attacks A Preventable Disaster (report)
  • download.bleepingcomputer.com — Samsamstringdecrypter.Zip (report)
  • blog.talosintel.com — Samsam Ransomware (report)
  • intelsecurity.com — Analysis Samsa Ransomware (report)
  • bleepingcomputer.com — New Samsam Variant Requires Special Password Before Infection (report)
  • bleepingcomputer.com — Samsam Ransomware Crew Made Nearly 6 Million From Ransom Payments (report)
  • sophos.com — Samsam The Almost Six Million Dollar Ransomware (report)
  • id-ransomware.blogspot.com — Samsam (report)
  • ransomlook.io — Samsam (report)
  • secureworks.com — Gold Lowell (report)
  • secureworks.com — Samsam Converting Opportunity Into Profit (report)
  • secureworks.com — Samas Ransomware (report)
  • secureworks.com — Ransomware Deployed By Adversary (report)
  • secureworks.com — Samsam Ransomware Campaigns (report)
  • jsac.jpcert.or.jp — Jsac2020 1 Tamada Yamazaki Nakatsuru En (report)
  • news.sophos.com — The Ransomware Threat Intelligence Center (report)
  • sites.temple.edu — Ci Rw Attacks (report)
  • cert.ssi.gouv.fr — Certfr 2020 Cti 001 (report)
  • nakedsecurity.sophos.com — The Rise Of Targeted Ransomware (report)
  • youtube.com — Watch (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Samsam (report)
  • justice.gov — Download (report)
  • justice.gov — Two Iranian Men Indicted Deploying Ransomware Extort Hospitals Municipalities And Public (report)
  • CrowdStrike — An In Depth Analysis Of Samsam Ransomware And Boss Spider (report)

External references