Samurai

Malware & Tools · Samurai

· MalwareS1099 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Samurai is a passive backdoor that has been used by ToddyCat since at least 2020. Samurai allows arbitrary C# code execution and is used with multiple modules for remote administration and lateral movement.(Citation: Kaspersky ToddyCat June 2022)

Tactic Coverage

command and control (6)stealth (5)discovery (3)execution (2)persistence (2)collection (1)defense impairment (1)privilege escalation (1)

Used By (1 groups)

G1022ToddyCat

Techniques (19)

T1005Data from Local System

collection

T1012Query Registry

discovery

T1027Obfuscated Files or Information

stealth

T1027.004Compile After Delivery

stealth

T1027.007Dynamic API Resolution

stealth

T1027.015Compression

stealth

T1036.005Match Legitimate Resource Name or Location

References

https://attack.mitre.org/software/S1099 https://securelist.com/toddycat/106799/