MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c827ebe6affd13781eba8a6751e4ee90168fe8511faa1e7b26bd96fdb9f281f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AokigaharaStealer

Vendor detections: 13

Intelligence 13 IOCs YARA 18 File information Comments

SHA256 hash:	8c827ebe6affd13781eba8a6751e4ee90168fe8511faa1e7b26bd96fdb9f281f
SHA3-384 hash:	aa4a711a6e4a80eb5c3b91a397f7375ddb19ac6d7aabe26eab8eaa22c578dd8a13264eb186d2d23bbc09672c85d25197
SHA1 hash:	21ef070e39f651118a804882374dc2dfa3e38666
MD5 hash:	b57099b095ed6f665ea8e768f3c6d1d1
humanhash:	rugby-oscar-salami-burger
File name:	aokigahara_payload_unpacked_fixed.bin
Download:	download sample
Signature	AokigaharaStealer Create hunting rule
File size:	217'088 bytes
First seen:	2026-10-12 19:44:48 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	98683c7201eb519500562ed22ebf8969 (1 x AokigaharaStealer)
ssdeep	6144:H3Y21r7MMVpBMiZA36q0WX0LG61Kckjh1q:H91r7npWiZA3aG37q
TLSH	T106244B03D68145FDD426C974CEC7D23BE6B2B8480575B6EB6FA0CE22AE50B50B93C649
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	Daydream
Tags:	aokigahara AokigaharaStealer exe memory-dump stealer unpacked

Daydream

UNPACKED MEMORY IMAGE, read before relying on this hash. AokigaharaStealer payload carved from the private RWX region 0x140000000-0x140034fff of the Go wrapper Glacier.exe (c9aee62eb43b64c0a09592027ab61d5aa287247f61de598d07e8da6998af4141) in a lab run on 2026-10-12. The file is the memory image with 24 header bytes changed by us so tools can parse it (FileAlignment and each section's raw offset and size set to their in-memory values); everything else is as captured, so imports show as resolved addresses and this hash matches no file on disk. Unmodified image sha256 9f89ee873b2548612fc8ea876f11629d9e87a39eea594dc88a676e492399e9cf. Payload: PE32+ built with MinGW, compiled 2026-09-30 15:13:31 UTC, debug-enabled build that writes %TEMP%\akg_debug.txt starting 'AOKIGAHARA DEBUG LOG'. Protocol seen decrypted in the lab: POST /gate/handshake (32-byte body, X-KEX: x25519), POST /gate/chunk per module (X-Chunk, X-Chunk-Index, X-Total: 20), POST /gate/complete; headers X-Build-ID, X-Gate-Token, X-Session, X-HWID; User-Agent Microsoft-CryptoAPI/10.0. Config in section .stgcfg ('CGTS' + length + IV + AES-256-CBC, key generated from the 32-bit seed 0x1967a43a): gate https://kkeyyou.cc/gate, build id 4f0b29e5. Same family as the unwrapped build bf037920d39b85572ec7e53b51f09c28198c2c0afbc7c7d6cf639b1f047caebf (gate https://neihite.cc/gate, build id d9c9ddf3, seed 0x4e4087dc). Write-up: https://github.com/dominion2/reverse-engineering-and-malware-analysis/blob/master/report/aokigahara-stealer.md

Intelligence

File Origin

# of uploads :

# of downloads :

220

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-10-12 19:48:25 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/3a491312-dc38-4ef7-9b6f-9ce1755c4951

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/91585/

Detection(s):

MiscreantPunch.SingleXOR.EXE.85.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad109adf4e17c78f715db9e

Tags:

vmdetect emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Sending a custom TCP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm cmd evasive explorer lolbin masquerade mpcmdrun obfuscated packed reconnaissance xor-pe xor-pe

Link:

https://www.filescan.io/uploads/6acd38d0e96b1cfd4521d4bd/reports/d8250ccb-7ad9-40fd-a328-c58cf64080b2/overview

Verdict:

Malicious

Labled as:

Dacic.11486.Generic

Link:

https://www.hybrid-analysis.com/sample/8c827ebe6affd13781eba8a6751e4ee90168fe8511faa1e7b26bd96fdb9f281f

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-12T17:52:00Z UTC

Last seen:

2026-10-13T19:18:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/8c827ebe6affd13781eba8a6751e4ee90168fe8511faa1e7b26bd96fdb9f281f/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/97107a6a-f7a2-45c0-8e4c-f751851cd4ba

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/8c827ebe6affd13781eba8a6751e4ee90168fe8511faa1e7b26bd96fdb9f281f

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/b57099b095ed6f665ea8e768f3c6d1d1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8c827ebe6affd13781eba8a6751e4ee90168fe8511faa1e7b26bd96fdb9f281f/

Threat name:

Win64.Trojan.CryptBot

Status:

Malicious

First seen:

2026-10-12 19:45:23 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

29 of 38 (76.32%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rsbh5ptk77itpaplvcthkhso5eawr7ufch5kdz5snpmw7w47fapq._file

Verdict:

malicious

Label(s):

AokigaharaStealer

Link:

https://reports.threatray.com/fe6e4777-ef80-4427-a6d5-afbd9cc643cf

Result

Malware family:

aokigahara

Score:

10/10

Tags:

family:aokigahara stealer

Link:

https://tria.ge/reports/261012-ygjdjaev21/

Behaviour

Family: Aokigahara

Unpacked files

SH256 hash:

8c827ebe6affd13781eba8a6751e4ee90168fe8511faa1e7b26bd96fdb9f281f

MD5 hash:

b57099b095ed6f665ea8e768f3c6d1d1

SHA1 hash:

21ef070e39f651118a804882374dc2dfa3e38666

Detections:

INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers

Link:

https://www.unpac.me/results/765d1105-92a4-4b47-8320-504e49f5b4ff/

SH256 hash:

3eefa0f6a36044c9172a441d8dba1bdf9bb21c9645af15eadaa9282e7e90e48a

MD5 hash:

c8ecce27ab174f2d2803c637ff54d612

SHA1 hash:

b4e37d79f8b1014b559344a13b0b7fe0b524447c

Detections:

triage_plugx_rat

Link:

https://www.unpac.me/results/765d1105-92a4-4b47-8320-504e49f5b4ff/

Malware family:

AokigaharaStealer

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8c827ebe6aff/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_VBox_Guest_Additions Create hunting rule

Rule name:	Check_VmTools Create hunting rule

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	dependsonpythonailib Create hunting rule
Author:	Tim Brown
Description:	Hunts for dependencies on Python AI libraries

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dsc Create hunting rule
Author:	Aaron DeVera
Description:	Discord domains

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many Password Manager software clients. Observed in infostealers

Rule name:	Macos_Infostealer_Wallets_8e469ea0 Create hunting rule
Author:	Elastic Security

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	test_rule_vldslv Create hunting rule

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.