S1099 Samurai

malwareEnterprise

platformsWindows

also known asSamurai

Samurai is a passive backdoor that has been used by ToddyCat since at least 2020. Samurai allows arbitrary C# code execution and is used with multiple modules for remote administration and lateral movement.

techniques used (19)

ATT&CK techniques this enables or maps to.

T1005Data from Local System
T1012Query Registry
T1027Obfuscated Files or Information
T1027.004Compile After Delivery
T1027.007Dynamic API Resolution
T1027.015Compression
T1036.005Match Legitimate Resource Name or Location
T1059.003Windows Command Shell
T1071.001Web Protocols
T1083File and Directory Discovery
T1090Proxy
T1095Non-Application Layer Protocol
T1105Ingress Tool Transfer
T1106Native API
T1112Modify Registry
T1132.001Standard Encoding
T1518Software Discovery
T1543.003Windows Service
T1573.001Symmetric Cryptography

used by groups (1)

Threat groups associated with this.

G1022ToddyCat

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan