Resubmissions
11/11/2026, 00:09
261111-afrfrady711004/11/2026, 23:01
261104-2zjzka1t6p724/10/2026, 03:32
261024-d34w5sstas1024/10/2026, 03:17
261024-dtgp9ahv4j10Analysis
- user interaction
yes - max time kernel
41s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-es - resource tags
- submitted
11/11/2026, 00:09
General
- Target samsam.exe
- Size 191KB
- Sample261111-afrfrady71
- SHA256 2f294d301d8bb9b947f41faf20df104710d5c4b2f469145d4e469ca7d1998b2f
Malware Config
Extracted
-
C:\Program Files\HELP_DECRYPT_YOUR_FILES.txt
- #What happened to your files? All of your important files encrypted with RSA-2048, RSA-2048 is a powerful cryptography algorithm For more information you can use Wikipedia *attention: Don't rename or edit encrypted files because it will be impossible to decrypt your files #How to recover files? RSA is a asymmetric cryptographic algorithm, You need two key 1-Public key: you need it for encryption 2-Private Key: you need it for decryption So you need Private key to recover your files, All of your network computers files is encrypted with one public key, So you need just one Private key to recover all computers files The private Key that we will send works on all your computers #How to get private key? It's not possible to recover your files without private key, You must send us 20,000$ USD in Bitcoin about(50 BTC) to receive private key For all affected computers After that we send your private key in our blogs. *Our blog address: https://www.anonyme.com/Blog/pikasoart *Our Bitcoin address:1FpZFUGqAkyjAGVgHXhaHrSmThJHxd2a7v We check our Bitcoin address every 2 hours After that we receive Bitcoins we send your Private Key in our blog #What is Bitcoin? Bitcoin is an innovative payment network and a new kind of money. You can create a Bitcoin account at https://blockchain.info/ and deposit some money into your account and then send to us #How to buy Bitcoin? There are many way to buy Bitcoin and deposit it into your account, You can buy it with WesternUnion, Bank Wire, International Bank transfer, Cash deposit and etc https://localbitcoins.com ---> Buy Bitcoin with WesternUnion or MoneyGram https://coincafe.com ---> Buy Bitcoin fast and Secure with WesternUnion and Cash deposit https://www.bitstamp.net ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://www.ccedk.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://bitcurex.com/ ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment If you want to pay with your Business bank account you should create a business account in exchangers they don't accept payment from third party #How to use private Key? We send you a simple software with private Key And you just need run this software on each computer that encrypted and all affected files will be decrypted #deadline You just have 72 hours to send us the Bitcoin after 72 hours we will remove your private key and it's impossible to recover your files
-
https://www.anonyme.com/Blog/pikasoart
Signatures
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Windows directory 2 IoCs
- Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Suspicious behavior: EnumeratesProcesses 35 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\samsam.exe"C:\Users\Admin\AppData\Local\Temp\samsam.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\selfdel.exe"C:\Users\Admin\AppData\Local\Temp\selfdel.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin" delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 10082⤵
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\samsam.exe"C:\Users\Admin\AppData\Local\Temp\samsam.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\selfdel.exe"C:\Windows\selfdel.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin" delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ar.txt.encryptedRSA
ba.txt.encryptedRSA
be.txt.encryptedRSA
bg.txt.encryptedRSA
bn.txt.encryptedRSA
co.txt.encryptedRSA
fr.txt.encryptedRSA
he.txt.encryptedRSA
hu.txt.encryptedRSA
hy.txt.encryptedRSA
ko.txt.encryptedRSA
mng2.txt.encryptedRSA
tg.txt.encryptedRSA
th.txt.encryptedRSA
ug.txt.encryptedRSA
yo.txt.encryptedRSA
CloseRevoke.htm.encryptedRSA
CloseRevoke.htm.encryptedRSA
CloseRevoke.htm.encryptedRSA
main.xml.encryptedRSA
zh-dayi.xml.encryptedRSA
EditComplete.jpg.encryptedRSA
ExitCompress.dot.encryptedRSA
ExportEnter.m4v.encryptedRSA
FindAdd.rtf.encryptedRSA
chrome.7z.encryptedRSA
HELP_DECRYPT_YOUR_FILES.txt
InstallUnpublish.rm.encryptedRSA
JoinRegister.potx.encryptedRSA
OptimizeResolve.potx.encryptedRSA
RedoCheckpoint.raw.encryptedRSA
TraceSubmit.jpeg.encryptedRSA
UndoDismount.docm.encryptedRSA
ThirdPartyNotices.txt.encryptedRSA
selfdel.exe
memory/3212-21-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3212-19-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3212-30-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3212-18-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3620-7-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3620-13-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3620-35-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3620-24-0x00007FFED530A000-0x00007FFED530B000-memory.dmp
memory/3620-20-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3620-22-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3620-0-0x00007FFED530A000-0x00007FFED530B000-memory.dmp
memory/3620-17-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3620-16-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3620-14-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3620-10-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3620-27-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3620-23-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3620-12-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3620-8-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3620-339-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3620-6-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3620-5-0x000000001C060000-0x000000001C0AE000-memory.dmp
memory/3620-4-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3620-3-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3620-29-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/3620-28-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/5440-36-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp
memory/5440-34-0x00007FFED5010000-0x00007FFED5A48000-memory.dmp