Samurai
Description
(Kaspersky) The final stage is a formerly unknown modular backdoor that we dubbed Samurai, due to a constant keyword used inside an important dictionary used by the malware to share data between its modules.
The library was developed in C# and uses the .NET HTTPListener class to receive and handle HTTP POST requests, looking for specially crafted requests that carry encrypted C# source code issued by the attackers. These programs will be in turn compiled and executed during runtime.
Names
| Name |
|---|
| Samurai |
Category
Malware
Type
- Reconnaissance
- Backdoor
- Loader
- Exfiltration
- Tunneling
Information
Mitre Attack
Other Information
Uuid
21f8ae06-a671-47b9-a2ff-158c7974f6c3
Last Card Change
2024-06-19