Samurai
- ID
- S1099
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 5 Jan 2024
Samurai is a passive backdoor that has been used by ToddyCat since at least 2020. Samurai allows arbitrary C# code execution and is used with multiple modules for remote administration and lateral movement.[1]
Techniques used (19)
- T1005 Data from Local System
- T1012 Query Registry
- T1027 Obfuscated Files or Information
- T1027.004 Compile After Delivery
- T1027.007 Dynamic API Resolution
- T1027.015 Compression
- T1036.005 Match Legitimate Resource Name or Location
- T1059.003 Windows Command Shell
- T1071.001 Web Protocols
- T1083 File and Directory Discovery
- T1090 Proxy
- T1095 Non-Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1112 Modify Registry
- T1132.001 Standard Encoding
- T1518 Software Discovery
- T1543.003 Windows Service
- T1573.001 Symmetric Cryptography