Destruction Level:<\/strong> Medium<\/p>\n Prevalence:<\/strong> Medium<\/p>\n <\/p>\n Trojans are a type of malware that masqurades themselves as legitimate and lawful software, behaving very similarly to useful and practical applications. The RisePro malware is a Trojan that collects system specs, browser logs, crypto wallet passwords, and screenshots of the victim and sends them to its command and control (C&C) server. <\/p>\n Non-infected libraries used by the malware, located in a randomly named folder in the %Temp%path.<\/p>\n Files like, Information.txt, passwords.txt, and other gathered information stored in a pseudorandomly-named folder in the %Temp%path (One of the two names has to be at least one character different from the othe).<\/p>\n Internet connections in specified paths in the sent\/received commands table to C&C servers.”<\/p>\n <\/p>\n RisePro malware utilizes several un-infected libraries for its operations. To do so, it creates them in a folder within the %Temp%path upon execution.”<\/p>\n Remote Server Connection Some command and control servers of this malware have the following structure:<\/p>\n Risepro malware commands include the followings:<\/p>\n \/get_marks.php:<\/p>\n List of the available services of the malware {\u201csuccess\u201d:true,\u201dresult\u201d:<\/p>\n {\u201cmarks\u201d:[{ \u201c_id\u201d:\u201dxxxx\u201d, \u201cuser\u201d:\u201dxxxx\u201d, \u201cname\u201d:\u201dBankiCA\u201d, \u201cdomains\u201d:\u201dbmo.com,cwbank.com,royalbank.com,vancity.com,servus.ca,coastcapitalsavings.com,alterna.ca,interiorsavings.com,synergycu.ca,mainstreetcu.ca\u201d, \u201ccolor\u201d:\u201dorange\u201d, \u201ccheckCookie\u201d:true, \u201ccheckPasswords\u201d:true, \u201ccheckHistory\u201d:false, \u201ccreatedAt\u201d:\u201d2023-01-26T08:49:30.239Z\u201d,\u201d__v\u201d:0}, \u201cuser\u201d:\u201dxxxx\u201d, \u201cname\u201d:\u201dSetiXyeti\u201d, \u201cdomains\u201d:\u201d\/vpn\/index.html,portal\/webclient,remote\/login,\/vpn\/tmindex.html,\/LogonPoint\/tmindex.html,XenApp1\/auth\/login.aspx,auth\/silentDetection.aspx,\/citrix\/,\/RDWeb\/,\/+CSCOE+\/,\/global-protect\/,sslvpn.,\/dana-na\/,\/my.policy\u201d, \u201ccolor\u201d:\u201dpurple\u201d, \u201ccheckCookie\u201d:true, \u201ccheckPasswords\u201d:true, \u201ccheckHistory\u201d:true, \u201ccreatedAt\u201d:\u201d2023-01-26T08:48:59.868Z\u201d,\u201d__v\u201d:0},{\u201c_id\u201d:\u201dxxxx\u201d, \u201cuser\u201d:\u201dxxxx\u201d, \u201cname\u201d:\u201dkajabi.com\u201d, \u201cdomains\u201d:\u201dkajabi.com,newkajabi.com\u201d, \u201ccolor\u201d:\u201dred\u201d, \u201ccheckCookie\u201d:false, \u201ccheckPasswords\u201d:true, \u201ccheckHistory\u201d:false, \u201ccreatedAt\u201d:\u201d2022-12-04T17:23:31.450Z\u201d,\u201d__v\u201d:0}, \u201cuser\u201d:\u201dxxxx\u201d, \u201cname\u201d:\u201dsteampowered.com\u201d, \u201cdomains\u201d:\u201dsteampowered.com\u201d, \u201ccolor\u201d:\u201dblue\u201d, \u201ccheckCookie\u201d:false, \u201ccheckPasswords\u201d:true, \u201ccheckHistory\u201d:false, \u201ccreatedAt\u201d:\u201d2022-12-04T14:57:23.380Z\u201d,\u201d__v\u201d:0}, \u201cuser\u201d:\u201dxxxx\u201d, \u201cname\u201d:\u201dhumblebundle\u201d, \u201cdomains\u201d:\u201dhumblebundle.com\u201d, \u201ccolor\u201d:\u201dgreen\u201d, \u201ccheckCookie\u201d:true, \u201ccheckPasswords\u201d:true, \u201ccheckHistory\u201d:false, \u201ccreatedAt\u201d:\u201d2022-11-23T15:58:09.126Z\u201d,\u201d__v\u201d:0}]}}<\/p>\n \u25ca \/get_settings.php:<\/p>\n Get settings from the server Examples of responses received from the server:<\/p>\n {\u201csuccess\u201d:true,\u201dresult\u201d:<\/p>\n {\u201csettings\u201d:{ \u201c_id\u201d:\u201dxxxx\u201d, \u201cHWIDduplicatesDay\u201d:true, \u201cHWIDduplicates\u201d:false, \u201cIPduplicates\u201d:false, \u201ctelegram\u201d:true, \u201cdiscord\u201d:true, \u201cscreenshot\u201d:true, \u201ccryptoWallets\u201d:true, \u201cnetHistory\u201d:true,<\/p>\n \u201cstaticMarks\u201d:\u201d\u201d, \u201ctelegramIds\u201d:[], \u201ccreatedAt\u201d:\u201d2022-06-20T23:57:13.984Z\u201d,\u201d__v\u201d:0}}}<\/p>\n \u25ca \/get_loader.php:<\/p>\n According to the malware\u2019s code, this function is related to receiving the executable file and executing it with the ShellExecute function.<\/p>\n \u25ca \/get_library.php:<\/p>\n Get the non-infected libraries needed to run the malware’s features, if they are not statically present in the file.<\/p>\n \u25ca \/set_file.php:<\/p>\n Send the file from the victim’s system to the server.<\/p>\n <\/p>\n Once the type of information to be collected from the victim’s system is determined ( response to the ‘\/get_settings’ query), RisePro gathers the information. The observed samples contain the following items:<\/p>\n 1. Hardware and software specs of the victim’s system. The malware obtains the victim’s IP address using the following addresses:”<\/p>\n https:\/\/ipinfo.io<\/p>\n https:\/\/db-ip.com<\/p>\n https:\/\/www.maxmind.com\/en\/locate-my-ip-address<\/p>\n The following image presents an example of information gathered by this malware:<\/p>\n Victim’s Screenshot Brave-Browser, CryptoTab Browser, Yandex, Atom, BlackHaw, Pale Moon, IceDragon,7Star, ChromePlus, Chromium, ChromiumViewer, Amigo, Chedot, Iridium, CentBrowser,Vivaldi, Elements Browser, Epic Privacy Browser, Citrio, Coowon, QIP Surf, Dragon, Orbitum,Torch, Comodo, 360Browser, Maxthon3, K-Melon, K-Meleon, Sputnik, Nichrome,CocCoc browser, NetboxBrowser, Firefox, Waterfox, Cyberfox, liebao, Kometa<\/p>\n Crypto wallets:<\/p>\n Terra, SaturnWallet, EQUALWallet, NiftyWallet, BitAppWallet, PaliWallet, NiftyWallet Other Softwares:<\/p>\n Battle.net, NVIDIA GeForce Experience, The information is stored in a file named passwords.txt, in which the name of the malware and its telegram address are included at the beginning.<\/p>\n Padvish antivirus detects and removes this malware from the system. Overview Type: Trojan Destruction Level: Medium Prevalence: Medium Malware name(s) Trojan.Win32. RisePro.a (Padvish) A Variant Of Win32\/TrojanDownloader.Agent.GNV (ESET) HEUR:Trojan-PSW.Win32.RisePro (Kaspersky) What is a Trojan? Trojans are a type of malware that masqurades themselves as legitimate and lawful software, behaving very similarly to useful and practical applications. However, when executed, they create numerous disruptions for…<\/p>\n","protected":false},"author":21,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-1342","post","type-post","status-publish","format-standard","hentry","category-trojan"],"_links":{"self":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1342","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/comments?post=1342"}],"version-history":[{"count":10,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1342\/revisions"}],"predecessor-version":[{"id":1547,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1342\/revisions\/1547"}],"wp:attachment":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/media?parent=1342"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/categories?post=1342"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/tags?post=1342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Malware name(s)<\/strong><\/h3>\n
\n
<\/h3>\n
What is a Trojan?<\/h3>\n
\nHowever, when executed, they create numerous disruptions for the system. In Some ways trojans enter a system including downloading software from the internet, embedding in HTML text, attaching to emails, and more.
\nUnlike computer viruses and worms, trojans cannot replicate themselves.<\/p>\n<\/h2>\n
What is RisePro malware?<\/h2>\n
\nAccording to the image published on the Telegram channel of this malware, this information is sold in full details. In addition, RisePro malware can receive malicious executable files from its C&C server, including ransomwares and other malwares, to run on the victim’s system.<\/p>\nTechnical Review<\/h2>\n
Indicators of Compromise (IoC)<\/h3>\n
Performance Description<\/h3>\n
![\"\"](\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2024\/01\/RisePro-1-1.png\")
<\/p>\n
\nAfter collecting initial victim information, such as IP address and system specs, RisePro malware establishes communication with its C&C server.<\/p>\n![\"\"](\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2024\/01\/RisePro-2.png\")
<\/p>\n
\nfor presentation to its clients.
\nExamples of responses received from the server:<\/p>\n
\n{\u201c_id\u201d:\u201dxxxx\u201d,<\/p>\n
\n{\u201c_id\u201d:\u201dxxxx\u201d,<\/p>\n
\n{\u201c_id\u201d:\u201dxxxx\u201d,<\/p>\n
\nIn this command the list of information that needs to be collected from the victim system is specified.<\/p>\nInformation Gathering<\/h3>\n
\n2. Victim system specs, including the operating system, language, system time, hardware specs, list of processes, and a list of system softwares.
\nAfter collection, this information is stored in a text file named Information.txt.<\/p>\n![\"\"](\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2024\/01\/RisePro-3.png\")
<\/h2>\n<\/h2>\n
\nBrowsers’ information, password stored in crypto wallets, and some other softwares: In the observed examples, the targeted softwares of the malware included the following items:
\nBrowsers:<\/p>\n
\nLiqualityWallet, Iwallet, MewCx, ForboleX, Metamask , Coinbase, RoninWallet, CloverWallet
\nCloverWallet<\/p>\n
\nThunderbird, uCozMedia, Authenticator, Wombat, KardiaChain<\/p>\n<\/h2>\n
How to deal with and clean t<\/strong>he system?<\/strong><\/h2>\n
![\"\"](\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2024\/01\/RisePro-4.png\")
<\/h2>\n
\nTo prevent potential infection caused by this malware, it is recommended to avoid downloading files from unreliable sources that could lead to system infection.<\/p>\n","protected":false},"excerpt":{"rendered":"