en
RisePro StealerRisePro (also known as RisePro Stealer) is an information-stealing malware family. RisePro targets browser credentials, cryptocurrency wallets, Telegram/Discord session tokens, System hardware, locale, and installed-software inventory and Password aggregate for offline brute-forcing (`brute.txt`). As of 11/10/2026, CyStack's research assesses medium attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
RisePro is a C++ info-stealer first documented in December
2022 and re-covered in 2023 when PrivateLoader began
redropping updated builds. A 2024 gitgub campaign writeup
catalogued RisePro v1.6 with FNV-1A dynamic import resolution,
XOR-obfuscated stack strings, TCP port 50500
command-and-control, and Base64-encoded ZIP exfiltration to
Telegram bot channels. Functionally it resembles Vidar:
browser credential grab, wallet grab, and a brute.txt
password aggregate for downstream brute-forcing.
The log documented here is not native RisePro output. It is
emitted by an in-house Python normalizer that a Telegram log
broker runs over raw stealer output before redistribution. The
tool writes leading-space Key: Value fields, a pipe-joined
Single-line params: hardware summary, an Original file:
reference to the operator working folder, and a Source: IP-API (https://ip-api.com/) geolocation attribution line.
The tool self-declares the family via a Stealer: field; here
it points at RisePro. The BRADMAX_CLOUD sibling format handles
the same wrapper when the tool cannot fingerprint the
underlying stealer (Stealer: Unknown).
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
