RisePro

RisePro is a Windows information-stealing malware family first observed in 2022 and commonly tracked as an infostealer offered and operated in cybercriminal ecosystems. It is designed to collect credentials, browser cookies, saved payment-card data, cryptocurrency wallet data, screenshots, host fingerprinting information, and selected files from infected systems. Targeted applications include major Chromium- and Gecko-based browsers, browser extensions associated with cryptocurrency wallets and two-factor authentication, and desktop applications such as Discord, battle.net, and Authy Desktop. RisePro also searches for wallet artifacts associated with multiple cryptocurrency clients and can package stolen data into archives for exfiltration.

The malware uses string and API obfuscation, dynamic import resolution, and in some cases embedded or remotely fetched legitimate DLLs to access browser data. It stages collected information in a temporary working directory, compresses the results, and communicates with command-and-control infrastructure over obfuscated HTTP using JSON-like messages protected with byte-substitution and XOR-based encoding. Reported command functionality includes retrieval of settings, grabber rules, and libraries, and available configuration indicates support for features such as screenshot capture, wallet theft, and collection of network-history data. Some analysis has suggested a possible loader capability, although that functionality has not been consistently observed in execution.

RisePro has been repeatedly associated with PrivateLoader-delivered infections, and multiple analyses have noted code, protocol, and infrastructure similarities between the two malware families, while stopping short of confirming a definitive development relationship. It has also appeared in multi-payload crimeware chains alongside other stealers and commodity malware. In observed Windows intrusions, RisePro established persistence through scheduled tasks and startup shortcuts, sometimes configured to run at logon and with elevated privileges.

Distribution has been linked to cracked-software lures, including fake installers and repositories masquerading as pirated software projects, as well as broader malware delivery ecosystems that use loaders to inject RisePro into legitimate Windows processes. RisePro has also been cited among infostealers whose stolen credentials were later abused in follow-on compromises, including access to enterprise services. The malware is widely recognized in the stealer landscape for theft of passwords, payment data, and cryptocurrency-related information from Windows endpoints.