Executive Summary
TOKYOCORE, attributed to the threat actor @meds, is a multi-functional threat acting as ransomware, an information stealer, and a destructive wiper. The malware employs theatrical 'fsociety' branding and leverages low-cost infrastructure including Discord webhooks for C2 and catbox[.]moe for payload hosting. Despite the small $50 ransom demand, the threat is severe due to its highly redundant persistence and lateral movement capabilities.
Technically, TOKYOCORE is notable for its 'scorched earth' wiper mode, which attempts to render systems unbootable by overwriting the Master Boot Record (MBR), clearing UEFI Secure Boot keys, and corrupting Windows boot files. The malware also harvests a wide range of sensitive data, including Discord tokens, browser credentials, and Wi-Fi passwords, before encrypting files or initiating its destructive sequence.
The inclusion of unstripped PDB paths and localhost C2 strings suggests the malware is distributed as a kit, likely in a Debug build. Organizations should treat TOKYOCORE infections as destructive events rather than simple ransomware, focusing on immediate isolation to prevent its worm-like propagation through Admin shares and Group Policy objects.