● Malware

Samurai

Samurai is a passive backdoor that has been used by ToddyCat since at least 2020. Samurai allows arbitrary C# code execution and is used with multiple modules for remote administration and lateral movement.

View graph Watch Export

Indicators tracked

Intelligence Reports10

10 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium

Connections

21 relationships

T1132.001: Standard Encoding

source

T1036.005: Match Legitimate Resource Name or Location

source

T1573.001: Symmetric Cryptography

source

T1543.003: Windows Service

source

T1106: Native API

source

T1005: Data from Local System

source

T1112: Modify Registry

source

T1090: Proxy

source

T1083: File and Directory Discovery

source

T1027: Obfuscated Files or Information

source

T1095: Non-Application Layer Protocol

source

T1012: Query Registry

source

T1027.004: Compile After Delivery

source

T1059.003: Windows Command Shell

source

T1071.001: Web Protocols

source

T1518: Software Discovery

source

T1105: Ingress Tool Transfer

source

T1027.007: Dynamic API Resolution

source

T1027.015: Compression

source