SamSam
MITRE ATT&CK: S0370 View on attack.mitre.org
Aliases: Samas, samsam.exe, MIKOPONI.exe, RikiRafael.exe, showmehowto.exe, SamSam Ransomware, SamSam, Samsam
- First seen
- 2016-01-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Operating systems
- windows
- Last IoC activity
- 2026-06-22 12:57:46
- Profile updated
- 2026-07-07 15:43:06
Targeted industries: healthcare-and-pharmaceutical government-and-public-sector education-and-nonprofits
Context
SamSam is ransomware that appeared in early 2016. Unlike some ransomware, its variants have required operators to manually interact with the malware to execute some of its core components.
Detection coverage
- 50 Sigma rules
Malware & tools used
- File Deletion (attack-pattern)
- Encrypted/Encoded File (attack-pattern)
- Windows Command Shell (attack-pattern)
- Junk Code Insertion (attack-pattern)
- Data Encrypted for Impact (attack-pattern)
Related threat objects
- V Is Vendetta (malware)
Reports & references
- CrowdStrike — Double Trouble Ransomware Data Leak Extortion Part 1 (report)
- secureworks.com — Gold Lowell (report)
- secureworks.com — Samsam Converting Opportunity Into Profit (report)
- secureworks.com — Samas Ransomware (report)
- secureworks.com — Ransomware Deployed By Adversary (report)
- secureworks.com — Samsam Ransomware Campaigns (report)
- Microsoft — Human Operated Ransomware Attacks A Preventable Disaster (report)
- download.bleepingcomputer.com — Samsamstringdecrypter.Zip (report)
- blog.talosintel.com — Samsam Ransomware (report)
- intelsecurity.com — Analysis Samsa Ransomware (report)
- bleepingcomputer.com — New Samsam Variant Requires Special Password Before Infection (report)
- bleepingcomputer.com — Samsam Ransomware Crew Made Nearly 6 Million From Ransom Payments (report)
- sophos.com — Samsam The Almost Six Million Dollar Ransomware (report)
- id-ransomware.blogspot.com — Samsam (report)
- ransomlook.io — Samsam (report)
- jsac.jpcert.or.jp — Jsac2020 1 Tamada Yamazaki Nakatsuru En (report)
- news.sophos.com — The Ransomware Threat Intelligence Center (report)
- sites.temple.edu — Ci Rw Attacks (report)
- cert.ssi.gouv.fr — Certfr 2020 Cti 001 (report)
- youtube.com — Watch (report)
- nakedsecurity.sophos.com — The Rise Of Targeted Ransomware (report)
- enterprise.verizon.com — 2019 Data Breach Investigations Report (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Samsam (report)
- justice.gov — Download (report)
- justice.gov — Two Iranian Men Indicted Deploying Ransomware Extort Hospitals Municipalities And Public (report)