Ransom.Samas

Short bio

Ransom.Samas is Malwarebytes’ detection name for a family of ransomware applications also known as SamSam ransomware.

Symptoms

Affected systems may display ransome notes similar to this one, after all the files have been encrypted.

Ransom.Samas ransom note

Type and source of infection

Ransom.Samas in general encrypts your files, then forces you to pay a ransom to get them back. The threat actors have been known to target cities and hospitals among others.
Ransom.Samas knows several variants, but most of them are spread by brute-forcing RDP endpoints.

Protection

Businesses should protect and limit the RDP access to their networks. You can find some pointers in the blogpost How to protect your RDP access from ransomware attacks.
Malwarebytes protects users from Ransom.Samas by using real-time protection.

Malwarebytes blocks Ransom.Samas

Business remediation

To remove Ransom.Samas using Malwarebytes business products, follow the instructions below.

How to remove Ransom.Samas with Malwarebytes Endpoint Protection

1. Go to the Malwarebytes Cloud console.
2. To allow you to invoke a scan while the machine is off the network, go to Settings > Policies > your policy > General.
3. Under Endpoint Interface Options, turn ON:
   1. Show Malwarebytes icon in notification area
   2. Allow users to run a Threat Scan (all threats will be quarantined automatically)
4. Temporarily enable Anti-Rootkit scanning for all invoked threat scans.
   Go to Settings > Policies > your policy > Endpoint Protection > Scan Options
5. Set Scan Rootkits to ON.
   
6. Once the endpoint has been updated with the latest policy changes:
   1. Take the client off the network
   2. From the system tray icon, run an Anti-Rootkit threat scan.
      

If you have infected machines that are not registered endpoints in Malwarebytes Endpoint Protection, you can remove Ransom.Samas with our Breach Remediation tool (MBBR).

1. Log into your My Account page and copy your license key. The key is needed to activate MBBR tool.
2. Open your Cloud console.
3. From a clean and safe machine, go to Endpoints > Add > Malwarebytes Breach Remediation. This will download the MBBR zip package.
4. Unzip the package.
5. Access a Windows command line prompt and issue the following commands:
   mbbr register –key:<prodkey>
   mbbr update
   Note: You must substitute your license key for <prodkey>.
6. Copy the MBBR folder to a flash drive.
7. From an infected, offline machine, copy the MBBR folder from the flash drive.
8. Start a scan using the following command:
   mbbr scan –full –ark –remove –noreboot
9. Refer to the Malwarebytes Breach Remediation Windows Administrator Guide for all supported scanning commands.

After removing the infection and restoring any lost files (if necessary) it is imperative to find out how the threat-actors gained access. Close the access and scan for any tools or backdoors they may have lft behind.

Consumer remediation

Malwarebytes can detect and remove Ransom.Samas without further user interaction.

1. Please download Malwarebytes to your desktop.
2. Double-click MBSetup.exe and follow the prompts to install the program.
3. When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
4. Click on the Get started button.
5. Click Scan to start a Threat Scan.
6. Click Quarantine to remove the found threats.
7. Reboot the system if prompted to complete the removal process.

Take note, however, that removing this ransomware does not decrypt your files. You can only get your files back from backups you made before the infection happened.