aokigahara | 02e7dd113c4911413701be3d9748f994e6b4b2b626efad9b9f89b2de065c2b31

General

Target
2026-10-26_8d4f9ba4787919320df197f735187e09_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver
Size 5.3MB
Sample261027-pchf1ady2r
SHA256 02e7dd113c4911413701be3d9748f994e6b4b2b626efad9b9f89b2de065c2b31
MD5 8d4f9ba4787919320df197f735187e09
SHA1 782ddcc36ff829acb4e5d2e0840f96bd03e6b5c4
SHA512 6a8fb186c4e43d181007c7606df1fe25853c1274173bf12959e079d03ec4685e8e4697dd887299bf13f701cf6817c8c2bf560a586d4c990ebb3560002ff2755c
SSDEEP 49152:d54FQxvt+08Wf5mAYfDWYRljPZ1ZVKd7IyBGK6er+dBU0tCpjrelNOfAjyZfT5qF:d7yGR7WSb2
TLSH
T183462807BE9455E8C096EA34C5BB8263B7617C8C833177E72E51AB742F717D0AA39B04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-26_8d4f9ba4787919320df197f735187e09_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver
- Size 5.3MB
- SHA256 02e7dd113c4911413701be3d9748f994e6b4b2b626efad9b9f89b2de065c2b31
- MD5 8d4f9ba4787919320df197f735187e09
- SHA1 782ddcc36ff829acb4e5d2e0840f96bd03e6b5c4
- SHA512 6a8fb186c4e43d181007c7606df1fe25853c1274173bf12959e079d03ec4685e8e4697dd887299bf13f701cf6817c8c2bf560a586d4c990ebb3560002ff2755c
- SSDEEP 49152:d54FQxvt+08Wf5mAYfDWYRljPZ1ZVKd7IyBGK6er+dBU0tCpjrelNOfAjyZfT5qF:d7yGR7WSb2
- TLSH
  T183462807BE9455E8C096EA34C5BB8263B7617C8C833177E72E51AB742F717D0AA39B04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery aokigahara spyware stealer
- Family: Aokigahara
  Aokigahara is a Windows stealer written in C.
  stealer aokigahara
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables referencing many Password Manager software clients. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2