RiseLoader

RiseLoader is a Windows loader.

Background

RiseLoader is a recently emerged malware loader family first seen in October 2024. It speaks a bespoke TCP-based binary protocol that resembles, yet differs from, the one used by the PrivateLoader and RisePro families. As secondary payloads it frequently delivers other families like Vidar, Lumma Stealer, and XMRig, and it gathers details about installed applications and browser extensions, probably with a cryptocurrency focus.

Notable technical traits of RiseLoader include:

Anti-analysis Techniques: Samples are commonly packed with VMProtect and obscure strings tied to malware-analysis and debugging tools.

Behavioural Analysis: It creates a mutex built from a hardcoded prefix plus random suffixes. It talks to a C2 server over TCP using a custom protocol with dedicated message types for jobs such as sending system information, pulling down payloads, and acknowledging execution. It fetches and runs payloads from URLs supplied by the C2 and writes registry keys to mark infections.

Network Communication: The custom TCP protocol uses message types including SEND_VICTIM_INFO, SYS_INFO, PAYLOADS, KEEPALIVE, and others. Traffic is XOR-encoded with keys negotiated through a SET_XORKEYS message, and the protocol features a three-way handshake along with reconnection logic.

Similarities to RisePro/PrivateLoader: Its comparable protocols and message layouts to RisePro and PrivateLoader hint at a shared developer lineage, although RiseLoader's protocol looks simpler. For now it lacks the information-stealing capabilities of RisePro/PrivateLoader, though those may still be in development.

Source: Malpedia (Fraunhofer FKIE).