{
  "family": "chir",
  "sample_count": 99,
  "category": "worm",
  "description": "W32.Chir (or Runouce) is a polymorphic file infector and mass-mailing worm that targets Windows environments. Upon execution, it searches local and network drives to infect executable files (.exe, .scr) by appending its viral code to the target files. Additionally, it harvests email addresses from the compromised system (often looking through Windows Address Book and HTML files) and uses its own SMTP engine to send infected email messages to those contacts. The emails typically contain deceptive subject lines and an infected attachment designed to trick the recipient into executing the worm. To maintain persistence and ensure it runs on every boot, Chir typically drops a copy of itself in the Windows system directory (e.g., as runouce.exe) and adds a corresponding entry in the Windows Registry Run keys.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "high",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1059",
    "T1105",
    "T1566.001",
    "T1114.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1114.001",
      "name": "Email Collection: Local Email Collection",
      "tactic": "Collection"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the infected machine from the network immediately to prevent network drive infection and mass-mailing.",
    "Block outbound SMTP traffic (port 25, 587) from non-authorized internal hosts at the firewall.",
    "Run a full system scan using a reputable anti-malware solution capable of disinfecting (stripping) polymorphic viral code from executables.",
    "Check and remove malicious Registry Run keys pointing to dropped binaries like 'runouce.exe'."
  ],
  "what_to_avoid": [
    "Do not execute unknown or unexpected email attachments, even if they appear to come from a known contact.",
    "Do not rely solely on simple file deletion, as the worm infects legitimate executable files which must be repaired rather than deleted."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}