RisePro is an information stealer first seen on Russian Market, a prominent dark-web marketplace for stolen credentials, in December 2022. From the start, researchers linked it to two other pieces of the same criminal ecosystem: Vidar, an older and well-documented stealer, and PrivateLoader, a pay-per-install service used to distribute other people's malware.
//Is RisePro a Vidar Fork?
Flashpoint concluded RisePro is very likely a clone of Vidar, based on RisePro reusing the same DLL dependencies that Vidar drops on an infected machine - a fairly specific technical overlap, not just a resemblance in what the stealer targets. Flashpoint also noted RisePro shares some traits with other stealer families, which is common in a criminal market where code and techniques circulate between operators.
The PrivateLoader connection
Separately, SEKOIA reported partial source code overlaps between RisePro and PrivateLoader - shared string obfuscation, similar HTTP method and port setup, and similar HTTP message obfuscation. SEKOIA put forward two explanations without settling on one: that RisePro is a PrivateLoader build preconfigured to fetch its own stealer component, or that PrivateLoader itself evolved and a separate vendor now distributes RisePro through it. Public reporting available for this rewrite does not say which explanation SEKOIA ultimately favoured.
Flashpoint's own samples suggested PrivateLoader was actively delivering RisePro in the period it studied, which Flashpoint read as a sign the stealer's operators trusted it enough to distribute through a commercial pay-per-install service rather than relying only on their own channels.
//What the Market Data Showed
At the time of these reports, RisePro had already been listed more than 2,000 times on Russian Market since its December 2022 debut - a fast ramp for a newly surfaced stealer, consistent with distribution through an established loader network rather than the operators building an audience from nothing.
//What This Rewrite Could Not Confirm
The sources available for this rewrite are concentrated around RisePro's December 2022 debut. Whether the RisePro/Vidar/PrivateLoader relationship described above has changed since - new divergence in targeting, evasion technique, or infrastructure, as the withdrawn version of this article claimed to track - was not something this rewrite found reporting on. Readers looking for current status should check Flashpoint or SEKOIA's more recent output directly rather than treat this page as current.