386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.zip
- SHA256 cdad9144f789c265c971f40b0fc695e4bb3d55d437c9e31ca8540e5a66ca18aa
Password
infected
Behavioral task
behavioral1
Sample
386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
35 signatures
900 seconds
Behavioral task
behavioral2
Sample
386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
30 signatures
900 seconds
General
- Target 386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.zip
- Size 736KB
- Sample261005-2e2c4swybs
- SHA256 cdad9144f789c265c971f40b0fc695e4bb3d55d437c9e31ca8540e5a66ca18aa
- MD5 5a3df68f0c85db6a9781f63d2c4224e8
- SHA1 81c90a6f5743b970e524160f864100e9ca020dca
- SHA512 fa79d32ae73343dc061d18b07dce02096d3e5b1fbaa8dcbd2d07b5f582c18d843afabe82d4bbbd05f4cc710e21d397d02ea86da17f6ed3a177c3184f5df656e2
- SSDEEP 12288:kYX0lb/42z9ZxSXSe1yvsiNAA8Th8mOI48FWr2zo+NnLKjdX5:fX0ZQw9YSe1viaA8oIvWyzo+Nn4X5
- TLSH T12DF4234D96D8FB830BE5999106929167FF18F7094F5090FA03BB8C6EA0CE66DE567C0C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: TokyoCore
TokyoCore is a Windows ransomware written in C++.
- Detects TokyoCore 1 IoCs
resource yara_rule static1/unpack001/386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe family_tokyocore - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
File Explorer
-
386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.zip.zip 736KB
-
386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe.exe 3.3MB
386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
- IMPHASH f5200c8f341553e67db607d46a282070
- SHA256 386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc
- MD5 d77aa7f5bf7c008232f4cbec127c30db
- SHA1 3701617822f99debbf2579602b32eb99034581ad
- SHA512 dca182637bcc510cfba855040df4f422c30b7c42af48351281534fde1804341bb7359d3c0e61c3cde8085273c1ad8387e248ab49bb92fce3724aa96c9a4615c9
- SSDEEP 24576:i7MuEwvKJEdcI63li+WsOxP5g2IvMJJHfO2NprH2K:sMupsvBWsOxPVZJWEzP
- TLSH T12EF5D91BF7B610D5E1BAC039D553622AFC7134A6833C97EB92818E491B60BE4EE3D750
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects TokyoCore
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
1304115
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Administrator\source\repos\ran with some\x64\Debug\TOKYOCORERansom.pdb
kernel32
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetLocalTime
GetTickCount64
GetSystemDirectoryW
SetSystemTime
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
CopyFileW
MoveFileW
MoveFileExW
GetComputerNameW
FileTimeToSystemTime
SystemTimeToFileTime
WTSGetActiveConsoleSessionId
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetEndOfFile
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetFilePointer
CreatePipe
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GlobalMemoryStatusEx
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
VirtualProtect
IsThreadAFiber
SetConsoleCtrlHandler
WriteConsoleW
OutputDebugStringW
GetFileType
HeapQueryInformation
HeapReAlloc
UnhandledExceptionFilter
RtlVirtualUnwind
ProcessIdToSessionId
CreateProcessW
GetExitCodeProcess
ExitProcess
GetCurrentProcessId
GetCurrentProcess
Sleep
WaitForSingleObject
GetLastError
CloseHandle
CheckRemoteDebuggerPresent
IsDebuggerPresent
GetTempPathW
SetFileAttributesW
ReadFile
GetLogicalDrives
GetFileSize
GetFileAttributesW
GetDriveTypeW
GetDiskFreeSpaceExW
FindFirstFileW
FindClose
DeleteFileW
CreateFileW
RtlCaptureContext
GetCurrentThread
GetStdHandle
IsProcessorFeaturePresent
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
DuplicateHandle
GetModuleHandleExW
TerminateProcess
GetConsoleOutputCP
WriteFile
CreateDirectoryW
GetTimeZoneInformation
ExpandEnvironmentStringsW
HeapValidate
HeapSize
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetLastError
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
FreeLibrary
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
InitializeSListHead
RaiseException
GetStartupInfoW
SetUnhandledExceptionFilter
GetCPInfo
CompareStringEx
GetStringTypeW
LCMapStringEx
DecodePointer
EncodePointer
RtlUnwind
WakeAllConditionVariable
WakeConditionVariable
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
CreateSymbolicLinkW
GetFileInformationByHandleEx
CreateHardLinkW
CopyFile2
CreateDirectoryExW
DeviceIoControl
AreFileApisANSI
CreateFile2
SetFileTime
SetFileInformationByHandle
GetFullPathNameW
GetFinalPathNameByHandleW
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
GetCurrentDirectoryW
SetCurrentDirectoryW
SleepConditionVariableSRW
TryAcquireSRWLockShared
TryAcquireSRWLockExclusive
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
GetLogicalProcessorInformationEx
GetExitCodeThread
GetCurrentThreadId
SwitchToThread
WaitForSingleObjectEx
GetSystemTimePreciseAsFileTime
QueryPerformanceFrequency
QueryPerformanceCounter
GetLocaleInfoEx
FormatMessageA
LocalFree
user32
CallNextHookEx
SystemParametersInfoW
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
DefWindowProcW
PostQuitMessage
RegisterClassW
CreateWindowExW
ShowWindow
SetWindowPos
BringWindowToTop
GetFocus
GetAsyncKeyState
SetTimer
KillTimer
GetSystemMetrics
UpdateWindow
SetForegroundWindow
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
RedrawWindow
SetWindowTextW
GetWindowTextW
GetClientRect
MessageBoxW
GetCursorPos
FindWindowW
SetWindowsHookExW
UnhookWindowsHookEx
gdi32
DeleteObject
CreateCompatibleBitmap
SetTextColor
SetBkMode
SetBkColor
SelectObject
GetStockObject
BitBlt
DeleteDC
CreateSolidBrush
CreateFontW
CreateCompatibleDC
advapi32
RegQueryInfoKeyW
GetUserNameW
RegCloseKey
RegSetValueExW
RegSetValueExA
RegQueryValueExW
CreateProcessAsUserW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
shell32
SHGetKnownFolderPath
SHGetFolderPathW
ShellExecuteW
ole32
CoTaskMemFree
CLSIDFromString
CreateStreamOnHGlobal
netapi32
NetShareEnum
NetApiBufferFree
iphlpapi
GetAdaptersInfo
crypt32
CryptBinaryToStringA
CryptStringToBinaryA
bcrypt
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptDestroyKey
BCryptDecrypt
BCryptGenerateSymmetricKey
BCryptEncrypt
winhttp
WinHttpReadData
WinHttpCloseHandle
WinHttpConnect
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpAddRequestHeaders
wininet
InternetCloseHandle
InternetOpenUrlW
InternetReadFile
InternetOpenW
gdiplus
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCreateStringFormat
GdipDeleteStringFormat
GdipAlloc
GdipFree
GdiplusStartup
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipLoadImageFromFile
GdipLoadImageFromFileICM
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipSaveImageToStream
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetInterpolationMode
GdipDrawRectangleI
GdipFillRectangleI
GdipDrawImageRectI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipDrawString
GdiplusShutdown
winmm
PlaySoundW
mciSendStringW
ws2_32
gethostbyname
gethostname
inet_ntoa
wtsapi32
WTSQueryUserToken
Name
.textbss
Size
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
2.6MB
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
524KB
Virtual Size
524KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
125KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.msvcjmc
Size
1024B
Virtual Size
725B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
1024B
Virtual Size
777B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
1024B
Virtual Size
563B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=205, id=261, version=33145,
count=14, id=260, version=33145,
count=8, id=259, version=33145,
count=10, id=259, version=35403,
count=19, id=260, version=35403,
count=103, id=261, version=35403,
count=1, id=262, version=33145,
count=33, id=257, version=33145,
count=300, id=1, productName=Unmarked objects,
count=1, id=261, version=35721,
count=1, id=255, version=35721,
count=1, id=258, version=35721,