Recently Discovered RisePro Malware Is a Vidar Stealer Derivative
The New Infostealer Has Already Gained Popularity and Was Spotted on the Russian Market.
RisePro, a new information-stealing malware, was recently observed on a dark web forum run by Russian cybercriminals. Since December 13, the virus has been offered for sale as a log credential stealer on underground forums, leading many to believe it is a clone of the Vidar Stealer.
RisePro’s appearance on the Russian market is evidence of the stealer’s growing popularity within the threat community, according to researchers at Flashpoint.
The security experts outlined a few key takeaways:
Samples that Flashpoint analysts identified indicate that RisePro may have been dropped or downloaded by the pay-per-install malware downloader service ‘PrivateLoader’ in the past year.
The appearance of the stealer as a payload for a pay-per-install service may indicate a threat actor’s confidence in the stealer’s abilities.
RisePro appears to be a clone of the stealer malware ‘Vidar’.
RisePro, a New Version of Vidar Stealer
Many of the new RisePro’s characteristics are comparable to those of Vidar Stealer. Researchers have highlighted one specific feature they have in common: they both use the same dynamic link library (DLL) dependencies, according to a Cyware alert.
“At the time of writing, Russian Market has featured over 2,000 logs allegedly sourced from RisePro”, noted the researchers.
Indicators Of Compromise (IOCs)
The identified hash samples of RisePro are the following:
Command and control (C2) domains:
RisePro command and control URI structure:
There has been an increase of Vidar clones, which experts attribute to the malware having been fully cracked and examined. Therefore, it is essential for companies to stay aware of the IoCs linked to RisePro and to take all measures to safeguard their data and other digital assets.
The complete report published by researchers at Flashpoint is available here.
If you liked this article, follow us on LinkedIn, Twitter, Facebook, Youtube, and Instagram for more cybersecurity news and topics.