New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages

MITRE Techniques

• [T1204.002] User Execution: Malicious File – used to trick victims into downloading ZIP archives from fake GitHub download pages (‘the infection chain is initiated when ZIP file is downloaded from a fake GitHub download page’).
• [T1574.001] Hijack Execution Flow: DLL Side‑Loading – loaders side‑load a malicious libcurl.dll which loads/decrypts launcher payloads (‘distributed ZIP file variants can contain an executable that side‑loads a libcurl.dll file’).
• [T1105] Ingress Tool Transfer – multiple components download additional payloads (BoryptGrab, TunnesshClient, Vidar variants, helper binaries) from attacker servers (‘downloads the BoryptGrab stealer’, ‘/api/client’, ‘/api/custom_exe?build={BUILD_NAME}’).
• [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder – HeaconLoad achieves persistence by adding a registry Run key (‘achieves persistence by adding a registry entry under the Run key’).
• [T1053.005] Scheduled Task/Job: Scheduled Task – launchers create scheduled tasks to execute downloaded TunnesshClient and other binaries (‘schedules tasks that use .xml files at %TEMP%client_task_system.xml and %TEMP%client_task_user.xml to execute the downloaded TunnesshClient’).
• [T1027] Obfuscated Files or Information – use of XOR/AES/Base64, opaque predicates, and junk code to hide strings and control flow (‘uses XOR-encrypted strings and contains opaque predicates with redundant code for obfuscation’).
• [T1555.003] Credentials from Web Browsers – BoryptGrab harvests browser passwords and uses Chrome App Bound Encryption bypass code to extract browser credentials (‘collects browser data…collects browser passwords’ and uses Chrome App Bound Encryption bypass code).
• [T1113] Screen Capture – the stealer captures screenshots of the victim system (‘then captures a screenshot and collects system information’).
• [T1005] Data from Local System – “File Grabber” functionality collects files with specified extensions from common directories (‘File Grabber ability, where it collects files with specified extensions under common directories’).
• [T1090.004] Proxy: SOCKS – TunnesshClient can act as a SOCKS5 proxy to forward attacker traffic (‘Act as SOCKS5 proxy’).
• [T1021.004] Remote Services: SSH – TunnesshClient establishes a reverse SSH tunnel and retrieves SSH credentials from the C2 (‘establishes a reverse Secure Shell (SSH) tunnel’ and ‘retrieves SSH credentials…’).
• [T1041] Exfiltration Over C2 Channel – collected data is archived and uploaded to attacker servers (‘archives and uploads its collected data to the attacker’s server’).
• [T1055] Process Injection – Vidar variants observed in the campaign can perform code injection or APC injection (‘can also perform code injection or APC injection’).
• [T1059.003] Command and Scripting Interpreter: Windows Command Shell – TunnesshClient supports executing shell commands sent by the attacker (‘Operation type 83: Execute shell command’).