malware

SameCoin S9030

Type: malware
Platforms: Windows, Android
Created: 20 April 2026
Last modified: 12 May 2026

SameCoin is a multi-platform wiper with Windows and Android versions that has been used by WIRTE to target entities in the Middle East including in Israel.[1]

Techniques44th pct

Tactics68th pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S9030

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk	The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco	Reconnaissance Active Scanning Stealth Masquerading Match Legitimate Resource Name or Location Credential Access OS Credential Dumping	-	medium	Bhavin Patel, Splunk, sventec, Github Community	2021-07-12	2026-09-22	a51bfe1a-94f0-48cc-b4e4-16a110145893	-
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
Splunk	The following analytic identifies attempts to delete AWS Bedrock Knowledge Bases, which are resources that store and manage domain-specific information for AI models. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Destruction	-	medium	Bhavin Patel, Splunk	2025-03-25	2026-05-13	8b4e3d62-f743-11ee-9f6e-acde48001123
	Detects when a EFS Fileshare Mount is modified or deleted. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Destruction	-	medium	Austin Songer @austinsonger	2021-08-15	2022-10-09	6a7ba45c-63d8-473e-9736-2eaabff79964
	Identifies when an EKS cluster is created or deleted.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Destruction	-	low	Austin Songer	2021-08-16	2022-10-09	33d50d03-20ec-4b74-a74e-1e65a38af1c0
	Detects when a Container Registry is created or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	low	Austin Songer @austinsonger	2021-08-07	2022-08-23	93e0ef48-37c8-49ed-a02c-038aab23628e
	Identifies when a device or device configuration in azure is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Data Manipulation Stored Data Manipulation	-	medium	Austin Songer @austinsonger	2021-09-03	2022-10-09	46530378-f9db-4af9-a9e5-889c177d3881
	Detects when a Azure Kubernetes Cluster is created or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	low	Austin Songer @austinsonger	2021-08-07	2022-08-23	9541f321-7cba-4b43-80fc-fbd1fb922808
	Identifies when a Azure Kubernetes network policy is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	08d6ac24-c927-4469-b3b7-2e422d6e3c43
	Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	25cb259b-bbdc-4b87-98b7-90d7c72f8743
	Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	7ee0b4aa-d8d4-4088-b661-20efdf41a04c
	Identifies when ClusterRoles/Roles are being modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	818fee0c-e0ec-4e45-824e-83e4817b0887
	Identifies when a service account is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Account Access Removal Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	12d027c3-b48c-4d9d-8bb6-a732200034b2
	Detects usage of "getcap" binary. (...)	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	2026-01-24	d8d97d51-122d-4cdd-9e2f-01b4b4933530
	Detects execution of ChromeLoader malware via a registered scheduled task	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task Persistence Software Extensions	-	high	@kostastsale	2022-01-10	—	0a74c5a9-1b71-4475-9af2-7829d320d5c2
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	The following analytic detects modifications to files with extensions commonly associated with ransomware. (...)	Generic	stable	file_event	windows	Sysmon	Impact Data Destruction	-	medium	David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk, Steven Dick	2019-10-16	2026-09-22	a9e5c5db-db11-43ca-86a8-c852d1b2c0ec
Splunk	The following analytic detects the creation of files with names commonly associated with ransomware notes. (...)	Hunting	stable	file_event	windows	Sysmon	Impact Data Destruction	-	medium	David Dorsey, Splunk	2019-10-16	2026-07-02	ada0f478-84a8-4641-a3f1-d82362d6bd71	-
	Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. (...)	Generic	test	-	-	Kubernetes Audit · Kubernetes	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Leo Tsaousis (@laripping)	2024-03-26	—	a80d927d-ac6e-443f-a867-e8d6e3897318
	Detects potential overwriting and deletion of a file using DD.	Generic	test	process_creation	linux	Sysmon	Impact Data Destruction	-	low	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC	2021-10-15	2022-07-07	2953194b-e33c-4859-b9e8-05948c167447
	Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot AP (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1)	2019-03-04	2022-10-09	958d81aa-8566-4cea-a565-59ccd4df27b0
	Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Impact Data Destruction	-	medium	frack113	2021-12-26	2023-02-21	4b046706-5789-4673-b111-66f25fe99534
Splunk	This detection identifies DNS queries to domains that match previously decommissioned S3 buckets. (...)	Anomaly	experimental	dns	windows	Sysmon	Impact Data Destruction	-	medium	Jose Hernandez, Splunk	2025-02-12	2026-05-13	2f1c5fd1-4b8a-4f5d-a0e9-7d6a8e2f5e1e
Splunk	This detection identifies web requests to domains that match previously decommissioned S3 buckets through web proxy logs. (...)	Anomaly	experimental	webserver	-	AWS	Impact Data Destruction	-	medium	Jose Hernandez, Splunk	2025-02-12	2026-05-13	3a1d8f62-5b9c-4e7d-b8f3-9d6a8e2f5e1f
	Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during (...)	Emerging	test	scheduled_job	windows	WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	CVE-2023-42793	critical	Nasreddine Bencherchali (Nextron Systems)	2023-10-24	—	3b8e5084-4de9-449a-a40d-0e11014f2e2d
	Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery	-	low	frack113	2022-08-20	2023-02-04	b4dc61f5-6cce-468e-a608-b48b469feaa2
Splunk	The following analytic detects excessive file deletion events in the Windows Defender folder. (...)	Generic	stable	file_event	windows	Sysmon	Impact Data Destruction	-	medium	Teoderick Contreras, Splunk, Steven Dick	2022-01-21	2026-05-13	b5baa09a-7a05-11ec-8da4-acde48001122
	Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	CVE-2015-1641	critical	Florian Roth (Nextron Systems)	2018-02-22	2021-11-27	7993792c-5ce2-4475-a3db-a3a5539827ef
	Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	informational	Daniil Yugoslavskiy, oscd.community, CheraghiMilad	2020-10-19	2024-12-01	d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72
	Detects usage of system utilities to discover files and directories	Generic	test	process_creation	macos	-	Discovery File and Directory Discovery	-	informational	Daniil Yugoslavskiy, oscd.community	2020-10-19	2022-11-25	089dbdf6-b960-4bcc-90e3-ffc3480c20f6
	Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (...)	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Nasreddine Bencherchali (Nextron Systems)	2024-06-24	—	13c02350-4177-4e45-ac17-cf7ca628ff5e
	Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). (...)	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)	2020-05-26	2026-07-28	d5866ddf-ce8f-4aea-b28e-d96485a20d3d
	Detects a flashplayer update from an unofficial location	Generic	test	proxy	-	-	Initial Access Drive-by Compromise Stealth Masquerading Match Legitimate Resource Name or Location Execution User Execution Malicious File	-	high	Florian Roth (Nextron Systems)	2017-10-25	2022-08-08	4922a5dd-6743-4fc2-8e81-144374280997
	Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Impact Data Destruction Stealth Indicator Removal	-	high	Ecco, E.M. Anhaus, oscd.community	2019-09-26	2023-09-09	add64136-62e5-48ea-807e-88638d02df1e
Splunk	The following analytic detects when a user removes an organization from GitHub Enterprise. (...)	Anomaly	stable	-	-	GitHub	Impact Data Destruction Initial Access Supply Chain Compromise	-	medium	Patrick Bareiss, Splunk	2025-01-15	2026-05-13	94cb89aa-aec1-4585-91b1-affcdacf357e
Splunk	The following analytic detects when a repository is archived in GitHub Enterprise. (...)	Anomaly	stable	-	-	GitHub	Impact Data Destruction Initial Access Supply Chain Compromise	-	medium	Patrick Bareiss, Splunk	2025-01-15	2026-05-13	8367cb99-bae1-4748-ae3b-0927bb381424
Splunk	The following analytic detects when a user deletes a repository in GitHub Enterprise. (...)	Anomaly	stable	-	-	GitHub	Impact Data Destruction Initial Access Supply Chain Compromise	-	medium	Patrick Bareiss, Splunk	2025-01-15	2026-05-13	f709e736-3e6c-492f-b865-bc7696cc24a7
Splunk	The following analytic detects when a repository is archived in GitHub Organizations. (...)	Anomaly	stable	cloud_audit	-	GitHub	Impact Data Destruction Initial Access Supply Chain Compromise	-	medium	Patrick Bareiss, Splunk	2025-01-15	2026-05-13	4f568a0e-896f-4d94-a2f7-fa6d82ab1f77
Splunk	The following analytic identifies when a repository is deleted within a GitHub organization. (...)	Anomaly	stable	cloud_audit	-	GitHub	Impact Data Destruction Initial Access Supply Chain Compromise	-	medium	Patrick Bareiss, Splunk	2025-01-15	2026-05-13	9ff4ca95-fdae-4eea-9ffa-6d8e1c202a71
	Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Syma (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Command and Control Ingress Tool Transfer Stealth Masquerading Match Legitimate Resource Name or Location	-	critical	Florian Roth (Nextron Systems)	2020-05-20	2023-03-09	3711eee4-a808-4849-8a14-faf733da3612
	Detects the creation of a schtask via PowerSploit or Empire Default Configuration.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Markus Neis, @Karneades	2018-03-06	2023-03-03	56c217c3-2de2-479b-990f-5c109ba8458f
	Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, ker (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery Discovery Process Discovery Discovery Query Registry Discovery System Information Discovery Discovery System Service Discovery	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali	2022-10-10	2024-11-23	fca949cc-79ca-446e-8064-01aa7e52ece5
	Detects when adversaries stop services or processes by deleting or disabling their respective schedu (...)	Generic	test	scheduled_job	windows	WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-12-05	2023-03-13	7595ba94-cf3b-4471-aa03-4f6baa9e5fad
	Detects Kapeka backdoor persistence activity. (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Swachchhanda Shrawan Poudel	2024-07-03	—	64a871dd-83f6-4e5f-80fc-5a7ca3a8a819
	Detects Kapeka backdoor scheduled task creation based on attributes such as paths, commands line flags, etc.	Emerging	test	scheduled_job	windows	WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Swachchhanda Shrawan Poudel	2024-07-03	—	6c130acd-0adb-4545-bcc4-2e85d0883c9a
	Detects binaries used by the Lazarus group which use system names but are executed and launched from (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	-	high	Trent Liffick (@tliffick), Bartlomiej Czyz (@bczyz1)	2020-06-03	2023-03-10	3f7f5b0b-5b16-476c-a85f-ab477f6dd24b
Splunk	The following analytic detects the deletion of SSH keys on a Linux machine. (...)	Anomaly	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	73a56508-1cf5-4df7-b8d9-5737fbdc27d2
Splunk	The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host. (...)	Generic	stable	process_creation	linux	Linux Auditd	Impact Data Destruction	-	medium	Teoderick Contreras, Splunk	2023-02-08	2026-05-13	4da5ce1a-f71b-4e71-bb73-c0a3c73f3c3c
Splunk	The following analytic detects suspicious database file and directory discovery activities, which may signal an attacker attempt to locate and assess critical database assets on a compromised system. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery File and Directory Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-23	2026-05-13	f616c4f3-bde9-41cf-856c-019b65f668bb
Splunk	The following analytic detects the use of the 'dd' command to overwrite files on a Linux system. (...)	Generic	stable	process_creation	linux	Linux Auditd	Impact Data Destruction	-	medium	Teoderick Contreras, Splunk	2024-08-09	2026-10-02	d1b74420-4cea-4752-a123-9b40dfcca49a

Title

Description

SameCoin S9030

SameCoin MITRE reference S9030

Standing S9030

Reach

Coverage

SameCoin detections S9030