RisePro stealer targets Github users in “gitgub” campaign

To complicate analysis, this file^[3] is bloated to 699 MB, which causes IDA and ResourceHacker to crash. The visualization of the sample by PortexAnalyzer shows that the bloat is non-trivial. While many bloated files feature appended zero bytes, this file has high entropy and no overlay. 

The bloat data resides in an RC_DATA PE resource named MICROSOFTVISUALSTUDIODEBUGGERI, which has a size of 0x2b85418f bytes. By removing this resource with CFF Explorer we successfully slimmed the file from 699 MB down to 3.43 MB.

Detect-it-Easy identifies an InnoSetup signature in this file, however, this signature turns out to be fake. The file is a .NET assembly. 

The .NET streams are unusual: Firstly, there are two #Blob and #Strings streams even though there can only be one according to the Common Language Infrastructure (CLI) specification (see II.24.2.2, page 272). Secondly, there is a #Schema stream, which is not part of the CLI (see II.24.2.2, page 272). The three faulty streams have an invalid size of one byte and point to the same offset. This is likely an attempt to break or confuse .NET parsers.

We identified the payload^[4] as RisePro stealer version 1.6. The version number stems from the stealer’s logs. We assume that this is the latest version of RisePro, as within the malware authors' publicly accessible Telegram channel, the most recent server updates are referred to as version 1.6. 

The sample resolves its imports dynamically using import hashing with Fowler–Noll–Vo hash 1A.

RisePro uses XOR obfuscated stack strings. A previous RisePro report by OALabs states that xorstr library has been used for RisePro's string obfuscation in the past, but it seems the encryption scheme has been changed in the meantime.

The library xorstr features "heavily vectorized compile time string encryption" and uses vpxor/pxor instructions to perform the XOR operations. A yara rule in the aforementioned OALabs report searches for pxor patterns in the binary. RisePro developers may have reacted to that public rule.

The new stack string decryption scheme uses one hardcoded decryption function for every string length that the stealer needs. All of these functions use the same underlying decryption algorithm but the length is hardcoded in the decryption loop.

We decrypted the strings with a Binary Refinery snippet, which prints the decrypted strings and their offsets in a format usable for Python dictionaries.

emit sample | 
	rex "\xC7(\x85|\x45).{4,8}\xC7(\x85|\x45).{50}" [| 
		put o offset | 
		rex "\xC7(\x85....|\x45.)(.{4})" {2} [| 
			nop ]| 
		alu -s "0-101" --inc "B^S" | 
		carve -n 4 printable | 
		resub \\ \\ | 
		resub \" \\\" | 
		cfmt {o} : \"{}\", ]] 

The snippet's regular expression matches a few unintended values, but it is not detrimental to set these as comments in the IDA database. We added the the output to the following IDAPython script.

import idc 

decrypted_strings_dict = { ... }

for k, v in decrypted_strings_dict.items(): 
    base = 0x400000 
    addr = k + base 
    comment = '"' + v + '"' 
    idc.set_cmt(addr, comment, 0) 
    print("comment", comment, "set at", addr) 

Address translation is not necessary here because the file offset and virtual addresses in the .text section are the same.

The sample communicates with a C2 server in a manner similar to what was discovered in November 2023 by the Any.Run team.

We used a Python script that was developed by an Any.Run researcher to decrypt network data. The threat actors have not changed their approach and are still using primarily TCP port 50500.  

The configuration packet was especially interesting, as it contains information about grabber components, Telegram bot API token, and a Telegram message template. 

Another packet contained base64 encoded data that after decoding turned out to be a .zip archive with information from our analysis machine.  

The data is exfiltrated to two Telegram channels. At the time of writing, both contained more than 700 messages with zip archives of stolen data. The combination of Telegram channel names and C2 IP addresses indicates a Russia-based operation.

The malware collects a variety of valuable information. All unique passwords are stored in a file named “brute.txt”. In the file “password.txt” we discovered a big RISEPRO banner and the link to the public Telegram channel.