MB-ad9a979e68a411ca15f5d003c37ada725d02c34d6c1b7f34c4dbbbed39a8dd4f
high
📛 Threat Title
AokigaharaStealer: glaicer.exe
Description
File type: exe. Size: 10383768 bytes. Tags: Aokigahara, AokigaharaStealer, exe, signed, Stealer. Reporter: AmadeyHunter. First seen: 2026-11-02 23:08:57.
Indicators of Compromise (4)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_imphash
d42595b695fc008ef2c56aabd8efd68e
IOC database
- Type
- hash_imphash
- Value
d42595b695fc008ef2c56aabd8efd68e- First seen
- Last seen
- Attached to this threat
- Appears in
- 891 threats
- Description
- imphash of URLhaus payload a7b9f3dda435b7f2…
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha256
ad9a979e68a411ca15f5d003c37ada725d02c34d6c1b7f34c4dbbbed39a8dd4f
IOC database
- Type
- hash_sha256
- Value
ad9a979e68a411ca15f5d003c37ada725d02c34d6c1b7f34c4dbbbed39a8dd4f- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- AokigaharaStealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
b0fed7064900e9c3a4ec2585f3baa49a03ad2853
IOC database
- Type
- hash_sha1
- Value
b0fed7064900e9c3a4ec2585f3baa49a03ad2853- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
6efe5b9d8e5e03e4ea2a43e0a49e57d6
IOC database
- Type
- hash_md5
- Value
6efe5b9d8e5e03e4ea2a43e0a49e57d6- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: exe. Size: 10383768 bytes. Tags: Aokigahara, AokigaharaStealer, exe, signed, Stealer. Reporter: AmadeyHunter. First seen: 2026-11-02 23:08:57.
Remediations (10)
-
web:bazaar.abuse.ch
Information on AokigaharaStealer malware sample (SHA256 6cd76d867cf850f6c638840a199f34d30e16200c9f065dfcffad973aed173bc3) MalwareBazaar uses YARA rules from several ...
-
web:cybersecuritynews.com
Aokigahara infostealer targets credentials and session data from ChatGPT, Claude, Codex, and Cursor on infected Windows computers.
-
web:dev.to
1. Overview Article Name: Infostealer riding the AI Train Publisher: Check Point Research Publication Date: 2026-10-23 Source: Check Point Research Related Sources: Dark Reading: Aokigahara Stealer Targets Developer Keyrings and AI Assistants Related Malware, Threat Groups, CVEs, and Products: Aokigahara, Kamidere, Stygian, Codex, ChatGPT Desktop, Claude, Cursor, Windsurf, GitHub Copilot ...
-
web:gridinsoft.com
This detection name identifies suspicious files displaying Trojan-like behavior patterns. It represents malware that masquerades as benign programs while executing unauthorized activities on the infected system.
-
web:tools.malwaretips.com
Is Glacier.exe safe? No, we rate this exact file malicious. Six major antivirus engines flag this new Go executable, one naming the Vidar stealer, and when it ran it force-closed every major browser and contacted a gate-style handshake…
-
web:tria.ge
Check this aokigahara report malware sample c9aee62eb43b64c0a09592027ab61d5aa287247f61de598d07e8da6998af4141, with a score of 10 out of 10.
-
web:www.joesandbox.com
Signatures Antivirus detection for URL or domain Detected unpacking (creates a PE file in dynamic memory) Malicious sample detected (through community Yara rule) Multi AV Scanner detection for submitted file Yara detected AOKIGAHARA Stealer AI detected suspicious PE / MSI digital signature Allocates memory in foreign processes Contain functionality to detect virtual machines Contains ...
-
web:www.joesandbox.com
Signatures Detected unpacking (creates a PE file in dynamic memory) Malicious sample detected (through community Yara rule) Multi AV Scanner detection for submitted file Yara detected AOKIGAHARA Stealer AI detected suspicious PE / MSI digital signature Allocates memory in foreign processes Contain functionality to detect virtual machines Contains functionality to inject code into remote ...
-
web:www.vmray.com
Remarks (1/1) Anti-Sleep Triggered (0x0200000E): The overall sleep time of all monitored processes was truncated from "23 minutes, 3 seconds" to "40 seconds" to reveal dormant functionality.
-
web:www.vmray.com
Remarks (1/1) Anti-Sleep Triggered (0x0200000E): The overall sleep time of all monitored processes was truncated from "23 minutes, 3 seconds" to "40 seconds" to reveal dormant functionality.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.