aokigahara | aokigahara_payload_unpacked_fixed[.]bin[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
aokigahara_payload_unpacked_fixed.bin.exe
Size 212KB
Sample261012-ygjdjaev21
SHA256 8c827ebe6affd13781eba8a6751e4ee90168fe8511faa1e7b26bd96fdb9f281f
MD5 b57099b095ed6f665ea8e768f3c6d1d1
SHA1 21ef070e39f651118a804882374dc2dfa3e38666
SHA512 641b86fa013fa90ea06d13e8ddd16909ae70851c80f5f6610ea9f6cffc467f498ddd2f9cc23b34b5ebd73bd707fd75931a8fb176d3639eadb90354301c54c7a1
SSDEEP 6144:H3Y21r7MMVpBMiZA36q0WX0LG61Kckjh1q:H91r7npWiZA3aG37q
TLSH
T106244B03D68145FDD426C974CEC7D23BE6B2B8480575B6EB6FA0CE22AE50B50B93C649
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer aokigahara

Malware Config

Signatures

Family: Aokigahara
Aokigahara is a Windows stealer written in C.
stealer aokigahara

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aokigahara_payload_unpacked_fixed.bin.exe

File Explorer

aokigahara_payload_unpacked_fixed.bin.exe

.exe 212KB

aokigahara_payload_unpacked_fixed.bin.exe

IMPHASH 98683c7201eb519500562ed22ebf8969
SHA256 8c827ebe6affd13781eba8a6751e4ee90168fe8511faa1e7b26bd96fdb9f281f
MD5 b57099b095ed6f665ea8e768f3c6d1d1
SHA1 21ef070e39f651118a804882374dc2dfa3e38666
SHA512 641b86fa013fa90ea06d13e8ddd16909ae70851c80f5f6610ea9f6cffc467f498ddd2f9cc23b34b5ebd73bd707fd75931a8fb176d3639eadb90354301c54c7a1
SSDEEP 6144:H3Y21r7MMVpBMiZA36q0WX0LG61Kckjh1q:H91r7npWiZA3aG37q
TLSH
T106244B03D68145FDD426C974CEC7D23BE6B2B8480575B6EB6FA0CE22AE50B50B93C649
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

CloseHandle ConnectNamedPipe CreateFileA CreateNamedPipeA CreateProcessA CreateRemoteThread CreateThread DeleteCriticalSection DeleteFileA EnterCriticalSection FindClose FindFirstFileA FindNextFileA GetCurrentProcess GetCurrentProcessId GetExitCodeThread GetFileAttributesA GetFileSize GetLastError GetLocalTime GetProcessHeap GetTempPathA GetTickCount HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LocalFree OpenProcess PeekNamedPipe ReadFile SetUnhandledExceptionFilter Sleep TerminateProcess TerminateThread UnmapViewOfFile VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile WriteProcessMemory lstrcatA lstrlenA

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

memcmp memcpy strchr strrchr strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _seh_filter_exe _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf fflush setvbuf

api-ms-win-crt-string-l1-1-0

strcmp strcpy strlen strncmp strncpy

user32

wsprintfA wvsprintfA

Name

.text

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.stgcfg

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

52KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

304B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

4KB

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

800B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

aokigahara_payload_unpacked_fixed.bin.exe

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

user32

generic