PrivateLoader PPI Service Found Distributing Info-Stealing RisePro Malware

Theft has always been a big discussion of time and when it comes to data theft it gets even bigger. So what is this PPI?

The pay-per-install (PPI) malware downloader service also known as Private Loader is basically being used to distribute a previously documented information-stealing malware dubbed RisePro.

Recently a stealer was spotted by Flashpoint on December 13, 2022, after it discovered "several sets of logs" exfiltrated operating the malware on an illicit cybercrime marketplace called Russian Market.

Vidar Stealer and RisePro have been sharing a resemblance recently, like another info-stealing malware.

Whereas RisePro is a C++-based malware. Also, Vidar Stealer itself is a fork of a stealer codenamed Arkei that appeared in 2018. This new game change of the stealer as a payload for a pay-per-install service is more like signifying a devil's will or its ability to run under everybody's nose. One of the threat intelligence companies noted in a write-up last week.

?

A Cybersecurity firm called SEKOIA, which cast out its own analyzed report of RisePro, further recognized a partial source code overlapping with PrivateLoader. This also encloses the string scrambling mechanism, HTTP method and port setup, and the HTTP message obfuscation method. As the name PrivateLoader directly indicates that is a download service that encourages its subscribers to deliver malicious payloads to target the host audiences.

It has been used in the past to deliver Vidar Stealer, RedLine Stealer, Amadeus, DanaBot, and NetDooka , among others, while masquerading as pirated software hosted on decoy sites or compromised WordPress portals that appear prominently on investigation results.

RisePro is not distinct from other info-stealers in that it's capable of stealing and sweeping a wide range of data from as many as 36 web browsers, which also includes cookies, passwords, credit cards, and crypto wallets, as well as gathering files of interest and loading more payloads.

It's is been served undercover more like offered for sale on Telegram, with the malware's developer also making it available as a Telegram channel. These channels enable criminal actors to interact with infected systems by providing a bot ID created by the stealer and sent to a remote server post a successful breach easily.

Along with that, they try to play smart and the malware's infrastructure is an administration panel hosted at a domain named my-rise[.]cc that allows access to stolen data logs, but that is possible only after signing into an account with a valid set of credentials.

It's currently not very transparent to say if RisePro is authored by the same set of threat actors behind PrivateLoader and if it's solely bundled alongside the PPI service.

"PrivateLoader is nevertheless active and comes with a set of new credentials," SEKOIA said. "Some resemblances between the stealer and PrivateLoader cannot be ignored just like that and provides additional insight into the threat actor growth."