SessionGate & BoryptGrab: TDS-Driven Infostealer Ecosystem OTX Analysis

---
title: Potential BoryptGrab Stealer Execution via GitHub Impersonation
id: 62e8a9b2-4f9d-4d2e-9a5c-3b1f2d5e6f7a
description: Detects execution of suspicious binaries or scripts originating from known impersonating GitHub profiles or downloading archives with specific characteristics associated with BoryptGrab.
status: experimental
date: 2026/07/03
author: Security Arsenal
references:
    - https://arcticwolf.com/resources/blog/security-bulletin-github-impersonation-deploys-information-stealer/
tags:
    - attack.defense_evasion
    - attack.t1195.002
    - attack.t1204.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\mshta.exe'
    selection_cli:
        CommandLine|contains:
            - 'github.com/antivirus-free-bitdefender'
            - 'github.com/malwarebytes-protection'
            - 'bentleyvazquezpvey.github.io'
            - 'boryptgrab'
            - '.zip'
    condition: all of selection_*
falsepositives:
    - Legitimate software downloads from GitHub (unlikely to use these specific impersonating handles)
level: high
---
title: Suspicious Network Connection to Smishing TDS Infrastructure
id: 93c4b8c1-5e0a-4b3f-8d2e-1f0g3h4i5j6k
description: Detects outbound connections to IP addresses identified in the Error 524 Decoy smishing operation and specific TDS domains.
status: experimental
date: 2026/07/03
author: Security Arsenal
references:
    - https://www.group-ib.com/blog/error-524-decoy-smishing/
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp|contains:
            - '43.159.'
            - '43.162.'
            - '43.165.'
            - '45.135.162.90'
            - '47.82.154.2'
            - '8.222.134.149'
    selection_domain:
        DestinationHostname|contains:
            - 'guiformat.com'
            - 'forestoaker.com'
            - 'baxe.pics'
            - 'buccstanor.pics'
            - 'maxdatahost1.cyou'
    selection_port:
        DestinationPort:
            - 48261
            - 28313
    condition: 1 of selection_*
falsepositives:
    - Rare, as these IPs/ports are not typical for corporate traffic.
level: critical
---
title: Potential RemusStealer or SessionGate Clipboard Modification
id: 14d5e9f0-6a7b-8c9d-0e1f-2g3h4i5j6k7l
description: Detects potential clipboard monitoring or replacement activity often associated with cryptocurrency clippers like RemusStealer or AnimateClipper.
status: experimental
date: 2026/07/03
author: Security Arsenal
references:
    - https://research.checkpoint.com/2026/impersonation-click-hijacking-and-tds-inside-a-malware-distribution-ecosystem/
tags:
    - attack.credential_access
    - attack.t1056.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_clipboard:
        CommandLine|contains:
            - 'Set-Clipboard'
            - 'Get-Clipboard'
            - 'clipboard'
    selection_suspicious:
        CommandLine|contains:
            - 'bitcoin'
            - 'ethereum'
            - '0x'
            - 'bc1'
    condition: all of selection_*
falsepositives:
    - User scripts involving cryptocurrency management.
level: medium


**KQL (Microsoft Sentinel)**
kql
// Hunt for network connections to known Smishing/TDS IPs
DeviceNetworkEvents
| where Timestamp > ago(1d)
| where RemoteIP has_any ("43.159.168.186", "43.162.84.202", "43.165.6.36", "45.135.162.90", "47.82.154.2", "8.222.134.149")
   or RemoteUrl has_any ("guiformat.com", "forestoaker.com", "baxe.pics", "buccstanor.pics", "roblox-com.com", "blox.ink", "robiox.com.ua")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl, RemotePort
| extend IOCScore = "Critical"


**PowerShell IOC Hunt Script**
powershell
# IOC Hunt for BoryptGrab and SessionGate related file hashes
$TargetHashes = @(
    "87361ba2bb412dcf49f8738f3b8b9b7dccb557ad2e76ea8d98ffa5b098ae3886", # SessionGate/RemusStealer Sample
    "b98575f3c0259b480a31b917aa73bc56", # BoryptGrab Sample 1
    "fd01262bd56510088b9ddfe58ca101ab"  # BoryptGrab Sample 2
)

$DrivesToScan = @("C:", "D:")

Write-Host "[+] Starting scan for known Stealer Hashes..."

foreach ($Drive in $DrivesToScan) {
    if (Test-Path $Drive) {
        Write-Host "[+] Scanning drive $Drive..."
        Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | 
        Where-Object { -not $_.PSIsContainer } | 
        ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($Hash -in $TargetHashes) {
                Write-Host "[!!!] MALICIOUS FILE FOUND: $($_.FullName) | Hash: $Hash" -ForegroundColor Red
            }
        }
    }
}
Write-Host "[+] Scan complete."