Technical Analysis of SamSam Ransomware
SamSam breached healthcare and government networks using stolen or brute-forced remote desktop credentials to gain a foothold, then moved manually through the network before an operator detonated the ransomware by hand. That operator-driven sequence, rather than the self-spreading behavior of worm-style ransomware, is what makes SamSam’s execution mechanics worth studying today. Hancock Memorial Hospital, Adams Memorial Hospital, and Allscripts each suffered SamSam breaches in early 2018, and the technical details behind those incidents still hold lessons for detection architecture.
Technical details
For SamSam ransomware to execute, it requires an input text file as the command line argument.
Once launched, SamSam removes its own installer through a self-delete routine.
Figure 1.0: code of the selfdel.exe
The ransomware encrypts 328 file extensions. The list of file extensions is shown in figure 2.0. Since the ransomware encrypts files across the system, it first calls DriveInfo.GetDrives() to enumerate every logical drive on the computer, shown in figure 3.0.
Figure 2.0: File extension targeted by SamSam ransomware
Figure 3.0: showing call to get the logical drives to the computer
To avoid disrupting the operating system itself, SamSam skips folders containing Windows, Reference Assemblies\Microsoft, or Recycle.Bin.
Figure 4.0: code showing ransomware skipping file in specific folders
Once encryption completes, an HTML file titled HELP_DECRYPT_YOUR_FILES containing the ransomware note gets dropped to the directory.
Figure 5.0: showing ransomware note
Deception-based detection
The ShadowPlex Preemptive Cybersecurity Platform alerts on the version of SamSam used in this breach, the moment a decoy asset is touched.
Figure: Detection of SamSam in ShadowPlex
Once the infected endpoint gets identified, it gets isolated from the network to prevent the spread of infection.
For further details about deception-based architecture to prevent infection, you can read Deception Centric Defense Against Ransomware.
How deception disrupts a ransomware kill chain
Deception intercepts SamSam before encryption by targeting the stages an operator has to complete by hand: credential-based access, network enumeration, and lateral movement, each of which a decoy account or breadcrumb can expose long before a payload ever runs.
SamSam is operator-launched rather than self-spreading: an attacker gains access through stolen or brute-forced credentials, then manually enumerates drives and shares before deploying the ransomware executable by hand. That sequence creates a real pre-encryption window, unlike worm-style ransomware that detonates within seconds. A decoy credential or breadcrumb along the enumeration path gives you a high-confidence alert well before any file gets touched. Detection at execution also does not depend on payload behavior, which matters because SamSam requires a public key passed at the command line, something a sandbox cannot supply.
Conclusion
A deception-based architecture detects and remediates during the execution of malware, which is why it is a strong complement to prevention-focused controls for ransomware defense. To execute SamSam ransomware, it requires the public key in a specific format from the command line argument.
Detonation-based sandboxes have no way to supply that key, so the malware has nothing to show when it runs there. Inline monitoring architectures are left correlating indirect signals rather than observing the encryption behavior itself, which is exactly the post-authentication window a decoy or breadcrumb is built to close.
See how 360 Deception intercepts ransomware like SamSam before encryption begins.
Frequently asked questions
Deception detects SamSam and similar ransomware at the access and enumeration stages that precede encryption, not once files start changing. A decoy account or credential placed along the paths an attacker enumerates has no legitimate use, so any interaction with it is inherently suspicious, giving you a high-confidence alert while the operator is still mapping the network, before a payload ever runs.
SamSam’s executable requires a valid public key, in a specific format, passed as a command line argument at launch. A sandbox detonating the file automatically has no way to supply that key, so the ransomware never runs its encryption routine to observe. Sandbox-based classification has little behavior to work with, which is why catching SamSam at execution, rather than by its detonation behavior, is what actually works.