BoryptGrab Stealer Uses Fake GitHub Pages to Deliver Data-Stealing Malware and a Reverse SSH Backdoor
Summary
Trend Micro analyzes BoryptGrab, distributed through deceptive GitHub repositories and download pages. The stealer harvests sensitive data and can deliver Vidar variants, a downloader, and a reverse-SSH backdoor.
Key points
- SEO-optimized public GitHub repositories pose as free software tools and direct users to deceptive download pages that deliver malicious ZIP files.
- Delivery routes include DLL side-loading with encrypted launcher payloads and obfuscated VBS scripts; one VBS route can add a Microsoft Defender exclusion for the C:\ drive.
- BoryptGrab can collect browser data and passwords, cryptocurrency wallet information, system details, screenshots, common files, Telegram data, and Discord tokens.
- The campaign can also deliver obfuscated Vidar variants and the HeaconLoad downloader, which uses a registry Run key and scheduled task for persistence.
- TunnesshClient establishes a reverse SSH tunnel and can act as a SOCKS5 proxy, run shell commands, and transfer or search for files.
- Russian-language comments and logs and Russia-located IP addresses suggest a possible Russian background, but do not establish the threat actor’s origin.
Article Details
- Attack Vectors
- SEO-optimized fake GitHub repositories impersonate free software tools and direct users to deceptive download pages.
- The download pages redirect through intermediary URLs and generate ZIP files containing malicious payloads.
- ZIP files deliver malware through DLL side-loading or VBS and other launcher-based download routes.
- Payloads download additional malware, including BoryptGrab, Vidar variants, HeaconLoad, and TunnesshClient.
- Defensive Notes
- The article provides Trend Micro detection and hunting queries for BORYPTGRAB, HeaconLoad, and TunnesshClient.
- Monitor for unauthorized Microsoft Defender exclusions; a VBS downloader is described as configuring an exclusion for the C:\ drive.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 193[.]143[.]1[.]104 | Attacker server address used by TunnesshClient for SSH credential retrieval and reverse-tunnel communications. |
| IPV4 | 45[.]93[.]20[.]195 | Attacker server address that receives local SSH credentials from a TunnesshClient variant. |
| IPV4 | 45[.]93[.]20[.]61 | Attacker server address from which BoryptGrab downloads a Chromium helper. |
| SHA256 | 0434437a073a3f3a49e84d5ecb20c99dd551bacc32bf100fbb8cf67a50642181 | Hash of another TunnesshClient variant that sets up a local SSH server on the victim machine. |
| SHA256 | 15de71073f44c657c23f5f97caa11f1b12e654d4d17684bfc628cc1e5b6bcdd5 | Hash of a C/C++ launcher variant that downloads BoryptGrab. |
| SHA256 | 1bd605ef84b6767df74bd6290f1468eed5a88264df23fcf70b6a75d5bdcf7d76 | Hash of a VBS downloader used to deliver malware in the campaign. |
| SHA256 | 2050468744e44554fac17fb83f1515c95f2f2236716e2b5267a81c2b94205e6a | Hash of an obfuscated Vidar variant that sends collected information to the attacker. |
| SHA256 | 2abe0ef88ba92db79d82cde4c0ed1f382bb347517a54ea82084c841d0f955518 | Hash of a HeaconLoad downloader sample used in the campaign. |
| SHA256 | 4264a88035aa0b63e9aef96daa78a58114d60a344ea10168a8ef5ef36bf8edbd | Hash of a .NET executable used to decode and run a VBS downloader. |
| SHA256 | 433a13cc70396f80dc29d1150c050339d78964fdc91bcdc3f40c67a77add1476 | Hash of a VBS downloader embedded in the described .NET executable route. |
| SHA256 | 449f528f5ceae8c3f8336d0d8e3e3ec9031d1ad67c31ee7311b67e01d5fdf225 | Hash of a launcher variant that downloads a payload from the campaign server. |
| SHA256 | 4e90d386c1c7d3d1fd4176975795a2f432d95685690778e09313b4a1dbab9997 | Hash of a BoryptGrab variant that can download TunnesshClient. |
| SHA256 | 576692df4bf1c7d8927d3a183f5219a81c3bff3dd22971691f8af6889f80c5a0 | Hash of the TunnesshClient sample described as connecting to the attacker’s server. |
| SHA256 | 7f2315b89fb9a47e1516def136844d617bfcdce19000a1b0436706692dbe166c | Hash of a launcher variant that downloads files from the campaign server. |
| SHA256 | c40b9913e79c5dd09751b1afb03aaa98658bab61bacf27a299abd84fd44fe707 | Hash of a launcher variant that downloads TunnesshClient. |
| SHA256 | d295720bc0c1111ce1c3d8b1bc1b36ba840f103b3ca7e95a5a8bf03e2cc44fe5 | Hash of a payload loaded from the malicious libcurl.dll resource section. |
| SHA256 | ed1745cc49b929e499966d87e163219fe0f24069fe88dfacbd69c0ebab85a640 | Hash of a Chromium helper downloaded by BoryptGrab to collect browser data. |
| SHA256 | fa767391b99865f8533efc1fe6dfa6175215718679fb00ca85fc13c3bd4ae4b7 | Hash of a libcurl.dll sample that side-loads a payload in the BoryptGrab campaign. |
| SHA256 | fe4e5fb28d2c2b3a640112b6b125ce8c4afa8be28342e3bfda097ad9dd2ef9ee | Hash of a BoryptGrab stealer variant. |
| URL | hxxps[:]//best-tinted[.]com/github-download.html | Malicious download page that generates a ZIP file used to deliver malware. |
| URL | hxxps[:]//botshield[.]vu/kFcjld | Payload-delivery URL used by a VBS downloader to retrieve a Base64-encoded executable. |
| URL | hxxps[:]//botshield[.]vu/KKRkm9 | Payload-delivery URL used by a VBS downloader to retrieve and execute a binary. |
| URL | hxxps[:]//github[.]com/Arena-Breakout-Infinite-ESP/.github | Campaign repository path containing scripts that fetch, decrypt, and redirect to URLs. |
| URL | hxxps[:]//github[.]com/Graphic-Editor-Krita/.github | Campaign repository path with commits adding Python scripts to simulate the deceptive download process. |
| URL | hxxps[:]//github[.]com/PassFab-4WinKey-Windows-Password-Reset | Campaign repository variant whose page sends tracking information to the attacker. |
| URL | hxxps[:]//github[.]com/Voicemod-Pro-Download-Tool | Attacker-created GitHub repository identified as a fake Voicemod Pro tool repository distributing malware. |
| URL | hxxps[:]//github[.]com/Voicemod-Pro-Download-Tool/.github | Attacker-created repository path hosting source code for the fake download page and its redirect. |
| URL | hxxps[:]//github[.]com/Yim-Mod-Menu/.github | Campaign repository path whose deleted script fetched an intermediate URL and redirected to it. |
| URL | hxxps[:]//kiamatka[.]com/kaiok.kakman | Intermediate URL hardcoded in the deceptive page to fetch a redirect destination. |
| URL | hxxps[:]//voicemod-pro-download-tool[.]github[.]io/.github/ | Deceptive download page linked from the fake Voicemod repository and used in the malware delivery chain. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelBoryptGrab uploads collected data to the attacker’s server.T1053.005 · Scheduled TaskThe launchers schedule tasks to execute TunnesshClient, and HeaconLoad also creates a scheduled task.T1055.004 · Asynchronous Procedure CallThe obfuscated Vidar variant is described as capable of APC injection.T1059.001 · PowerShellThe VBS downloader executes decoded PowerShell payloads.T1059.005 · Visual BasicVBS downloader scripts decode commands and deliver executable payloads.T1090 · ProxyTunnesshClient can operate as a SOCKS5 proxy for attacker traffic.T1105 · Ingress Tool TransferLaunchers and malware download BoryptGrab, TunnesshClient, Vidar variants, and other payloads.T1113 · Screen CaptureBoryptGrab captures screenshots from infected systems.T1140 · Deobfuscate/Decode Files or InformationCampaign components decode Base64 data and decrypt XOR- or AES-protected URLs and payloads.T1204.002 · Malicious FileVictims download and execute ZIP-delivered executables or scripts from deceptive software download pages.T1547.001 · Registry Run Keys / Startup FolderHeaconLoad establishes persistence by adding a registry entry under the Run key.T1555.003 · Credentials from Web BrowsersBoryptGrab collects browser passwords and other browser data.T1560.001 · Archive via UtilityBoryptGrab archives collected data before uploading it to the attacker’s server.T1562.001 · Disable or Modify ToolsA VBS downloader configures a Microsoft Defender exclusion for the C:\ drive.T1572 · Protocol TunnelingTunnesshClient establishes a reverse SSH tunnel for attacker communications and traffic forwarding.
Malware
BoryptGrabNew BoryptGrab Stealer Targets Windows Users via Deceptive GitHub PagesHeaconLoadThe launcher payload can also download an executable — a binary written in Golang (which we dubbed as HeaconLoad) from “:5466/api/lodik”.TunnesshClientTunnesshClient is a new backdoor delivered during the attack chain.VidarThis campaign can also deliver variants of the existing Vidar stealer with code obfuscation.
Products
DiscordIt is also capable of capturing screenshots, collecting common files, and extracting Telegram information, Discord tokens, and passwords.GitHubNew BoryptGrab Stealer Targets Windows Users via Deceptive GitHub PagesMicrosoft Defender Antimalware PlatformThe final deobfuscated commands in the VBS script can also set Microsoft Defender exclusions to prevent the C:\ drive from performing anti-virus scanning.Microsoft WindowsNew BoryptGrab Stealer Targets Windows Users via Deceptive GitHub PagesTelegramIt is also capable of capturing screenshots, collecting common files, and extracting Telegram information, Discord tokens, and passwords.