Malware

RisePro

RisePro is a Windows information-stealing malware family first observed in 2022 and commonly tracked as an infostealer offered and operated in cybercriminal ecosystems. It is designed to collect credentials, browser cookies, saved payment-card data, cryptocurrency wallet data, screenshots, host fingerprinting information, and selected files from infected systems. Targeted applications include major Chromium- and Gecko-based browsers, browser extensions associated with cryptocurrency wallets and two-factor authentication, and desktop applications such as Discord, battle.net, and Authy Desktop. RisePro also searches for wallet artifacts associated with multiple cryptocurrency clients and can package stolen data into archives for exfiltration.

The malware uses string and API obfuscation, dynamic import resolution, and in some cases embedded or remotely fetched legitimate DLLs to access browser data. It stages collected information in a temporary working directory, compresses the results, and communicates with command-and-control infrastructure over obfuscated HTTP using JSON-like messages protected with byte-substitution and XOR-based encoding. Reported command functionality includes retrieval of settings, grabber rules, and libraries, and available configuration indicates support for features such as screenshot capture, wallet theft, and collection of network-history data. Some analysis has suggested a possible loader capability, although that functionality has not been consistently observed in execution.

RisePro has been repeatedly associated with PrivateLoader-delivered infections, and multiple analyses have noted code, protocol, and infrastructure similarities between the two malware families, while stopping short of confirming a definitive development relationship. It has also appeared in multi-payload crimeware chains alongside other stealers and commodity malware. In observed Windows intrusions, RisePro established persistence through scheduled tasks and startup shortcuts, sometimes configured to run at logon and with elevated privileges.

Distribution has been linked to cracked-software lures, including fake installers and repositories masquerading as pirated software projects, as well as broader malware delivery ecosystems that use loaders to inject RisePro into legitimate Windows processes. RisePro has also been cited among infostealers whose stolen credentials were later abused in follow-on compromises, including access to enterprise services. The malware is widely recognized in the stealer landscape for theft of passwords, payment data, and cryptocurrency-related information from Windows endpoints.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

37 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1590Gather Victim Network InformationEvidence1

We can begin by performing a basic search for the c2 on Censys... This search reveals some basic information such as running services, ASN and the location of the server.

Resource Development

1 technique

T1583.001DomainsEvidence1

We identified at least 13 such repositories belonging to a RisePro stealer campaign that was named “gitgub” by the threat actors. The repositories look similar, featuring a README.md file with the promise of free cracked software.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

Ce malware cible principalement Windows et se propage souvent via phishing, téléchargements malveillants ou logiciels piratés.

T1566PhishingEvidence1

Ce malware cible principalement Windows et se propage souvent via phishing, téléchargements malveillants ou logiciels piratés.

Execution

4 techniques

T1053Scheduled Task/JobEvidence1

It then starts a scheduled task named 'GoogleUpdateTaskMachineQC' ... (T1053: Scheduled Task/Job).

T1053.005Scheduled TaskEvidence2

Process 4192 runs a command that will start a scheduled task called “GoogleUpdateTaskMachineQC” using schtasks... (T1053.005 – Scheduled Task/Job: Scheduled Task).

T1129Shared ModulesEvidence1

Some samples of RisePro embed legitimate DLLs such as sqlite3.dll and mozglue.dll used to access the web browsers data. Theses DLLs are stored in cleartext in the PE, they are dumped on the disk in the working directory of the malware

T1204User ExecutionEvidence1

The unsuspecting user must unpack several layers of archives using the password "GIT1HUB1FREE" before they reach the first executable file named Installer_Mega_v0.7.4t.msi.

Persistence

4 techniques

T1053Scheduled Task/JobEvidence1

It then starts a scheduled task named 'GoogleUpdateTaskMachineQC' ... (T1053: Scheduled Task/Job).

T1053.005Scheduled TaskEvidence2

Process 4192 runs a command that will start a scheduled task called “GoogleUpdateTaskMachineQC” using schtasks... (T1053.005 – Scheduled Task/Job: Scheduled Task).

T1547Boot or Logon Autostart ExecutionEvidence1

The explorer.exe file drops 'C:\Users\admin\AppData\Roaming\bdutbcd' ... It automatically executes upon system reboot via Task Scheduler ... (T1547: Boot or Logon Autostart Execution).

T1547.001Registry Run Keys / Startup FolderEvidence3

Persistence may be achieved by adding a program to a startup folder... (T1547.001 – Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder).

Privilege Escalation

5 techniques

T1053Scheduled Task/JobEvidence1

It then starts a scheduled task named 'GoogleUpdateTaskMachineQC' ... (T1053: Scheduled Task/Job).

T1053.005Scheduled TaskEvidence2

Process 4192 runs a command that will start a scheduled task called “GoogleUpdateTaskMachineQC” using schtasks... (T1053.005 – Scheduled Task/Job: Scheduled Task).

T1055Process InjectionEvidence2

During execution, the loader connects to hxxp://176.113.115(dot)227:56385/31522 and injects its payload [4] into either AppLaunch.exe or RegAsm.exe.

T1547Boot or Logon Autostart ExecutionEvidence1

The explorer.exe file drops 'C:\Users\admin\AppData\Roaming\bdutbcd' ... It automatically executes upon system reboot via Task Scheduler ... (T1547: Boot or Logon Autostart Execution).

T1547.001Registry Run Keys / Startup FolderEvidence3

Persistence may be achieved by adding a program to a startup folder... (T1547.001 – Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder).

Stealth

7 techniques

T1027Obfuscated Files or InformationEvidence2

To complicate analysis, this file [3] is bloated to 699 MB which causes IDA and ResourceHacker to crash... The file is obfuscated with a version of .NET Reactor 6 and has virtualization enabled... RisePro uses XOR obfuscated stack strings.

T1027.005Indicator Removal from ToolsEvidence1

TTPs Table 3. MITRE ATT&CK TTPs for RisePro Stealer ... Defense Evasion T1027.005 – Obfuscated Files or Information: Indicator Removal from Tools

T1027.007Dynamic API ResolutionEvidence1

The sample resolves its imports dynamically using import hashing with Fowler–Noll–Vo hash 1A.

T1036MasqueradingEvidence1

The repositories look similar, featuring a README.md file with the promise of free cracked software. Green and red circles are commonly used on Github to display the status of automatic builds. Gitgub threat actors added four green Unicode circles to their README.md that pretend to display a status alongside a current date and provide a sense of legitimacy and recency.

T1055Process InjectionEvidence2

During execution, the loader connects to hxxp://176.113.115(dot)227:56385/31522 and injects its payload [4] into either AppLaunch.exe or RegAsm.exe.

T1140Deobfuscate/Decode Files or InformationEvidence1

The downloaded file is obfuscated using bytes substitution followed by a XOR operation with a fixed key.

T1497.003Time Based ChecksEvidence2

The purpose is to evade analysis environments with time-based methods, and the Windows Task Scheduler can be abused... (T1497.003 – Virtualization/Sandbox Evasion: Time Based Evasion, and T1053.005 – Scheduled Task/Job: Scheduled Task).

Defense Impairment

1 technique

T1222File and Directory Permissions ModificationEvidence1

TTPs Table 3. MITRE ATT&CK TTPs for RisePro Stealer ... Defense Evasion T1222 – File and Directory Permissions Modification

Credential Access

2 techniques

T1555Credentials from Password StoresEvidence2

“History” contained the Edge Browser history, “Login Data” contained the Edge Browser login data, “Cookies” contained the Edge browser cookies...

T1555.004Windows Credential ManagerEvidence1

TTPs Table 3. MITRE ATT&CK TTPs for RisePro Stealer ... Credential Access T1555.004 – Credentials from Password Stores: Windows Credential Manager

Discovery

10 techniques

T1012Query RegistryEvidence1

Host fingerprinting RisePro Stealer has a fingerprint capability, all information are retrieved in the following registry keys

T1033System Owner/User DiscoveryEvidence1

TTPs Table 3. MITRE ATT&CK TTPs for RisePro Stealer ... Discovery T1033 – System Owner/User Discovery

T1057Process DiscoveryEvidence1

TTPs Table 3. MITRE ATT&CK TTPs for RisePro Stealer ... Discovery T1057 – Process Discovery

T1082System Information DiscoveryEvidence1

Host fingerprinting RisePro Stealer has a fingerprint capability

T1083File and Directory DiscoveryEvidence1

The stealer also looks for particular file patterns, for example receipt with credit card information in common folders (for instance, Desktop, Download, %TEMP%).

T1087Account DiscoveryEvidence1

TTPs Table 3. MITRE ATT&CK TTPs for RisePro Stealer ... Discovery T1087 – Account Discovery

T1497.003Time Based ChecksEvidence2

T1518Software DiscoveryEvidence1

The stealer targets cookies, saved passwords, saved credit cards and crypto wallets and also installed softwares for credentials.

T1614System Location DiscoveryEvidence1

RisePro retrieves the infected host public IP address with a fallback functionality. It attempts to get this information from ipinfo.io fails, it tries on api.db-ip.com. Should this also fail, a last option is to contact maxmind.com

T1614.001System Language DiscoveryEvidence1

TTPs Table 3. MITRE ATT&CK TTPs for RisePro Stealer ... Discovery T1614.001 – System Location Discovery: System Language Discovery

Collection

3 techniques

T1113Screen CaptureEvidence1

The stealer also takes a screenshot of the infected host.

T1213Data from Information RepositoriesEvidence1

TTPs Table 3. MITRE ATT&CK TTPs for RisePro Stealer Tactic Technique Collection T1213 – Data from Information Repositories

T1560Archive Collected DataEvidence2

Another packet contained base64 encoded data that after decoding turned out to be a .zip archive with information from our analysis machine.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence4

The sample communicates with a C2 server in a manner similar to what was discovered in November 2023... The threat actors have not changed their approach and are still using primarily TCP port 50500.

T1105Ingress Tool TransferEvidence1

In case these DLLs are not embedded in the malware, it fetches them on its C2 by requesting the /get_library endpoint with a POST request

T1571Non-Standard PortEvidence1

During the sandbox analysis, 'AppLaunch.exe' was seen steadily beaconing to its C2 over port 23929 approximately every five seconds (T1571: Non-Standard Port).

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence3

Another packet contained base64 encoded data that after decoding turned out to be a .zip archive with information from our analysis machine.

T1567Exfiltration Over Web ServiceEvidence1

The data is exfiltrated to two Telegram channels. At the time of writing, both contained more than 700 messages with zip archives of stolen data.

INDICATORS OF COMPROMISE

IOCs tracked for this family

325 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

31 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

69 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

225 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app1 year ago

uri●●●●●●●●●●●●View more in app1 year ago

hash.sha256●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

24 SOURCESView more in app

cyber security newsNews

Jul 21, 2026

Top 10 Malware’s used by Hackers Last Week to Launch Cyberattacks

Mentioned as another malware family distributed by the same loader ecosystem as StealC.

threataft blogNews

Jun 14, 2026

OnyxC2 MaaS Stealer: Enterprise Credential Theft for $250/Month | ThreatAft

Referenced only as another stealer compared against OnyxC2.

codebyNews

Jun 9, 2026

Детектирование инфостилеров: IOC и SIEM-правила

Инфостилер, для которого характерным артефактом является файл passwords.txt.

codebyNews

May 25, 2026

Identity-based атаки APT 2026: detection и hardening

Инфостилер, упомянутый как один из вариантов, обеспечивавших поток украденных учётных данных для кампании против Snowflake.

+16 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching325

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping37

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

RisePro