Procedure examples

Samurai can leverage an exfiltration module to download arbitrary files from compromised machines.

Samurai can query `SOFTWARE\Microsoft\.NETFramework\policy\v2.0` for discovery.

Samurai can encrypt the names of requested APIs.

Samurai can compile and execute downloaded modules at runtime.

Samurai can encrypt API name strings with an XOR-based algorithm.

Samurai can deliver its final payload as a compressed, encrypted and base64-encoded blob.

Samurai has created the directory `%COMMONPROGRAMFILES%\Microsoft Shared\wmi\` to contain DLLs for loading successive stages.

Samurai can use a remote command module for execution via the Windows command line.

Samurai can use a .NET HTTPListener class to receive and handle HTTP POST requests.

Samurai can use a specific module for file enumeration.

Samurai has the ability to proxy connections to specified remote IPs and ports through a a proxy module.

Samurai can use a proxy module to forward TCP packets to external hosts.

Samurai has been used to deploy other malware including Ninja.

Samurai has the ability to call Windows APIs.

The Samurai loader component can create multiple Registry keys to force the svchost.exe process to load the final backdoor.

Samurai can base64 encode data sent in C2 communications prior to its encryption.

Samurai can check for the presence and version of the .NET framework.

Samurai can create a service at `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost` to trigger execution and maintain persistence.

Samurai can encrypt C2 communications with AES.