# RisePro TCP v.0.1 **URL:** \ **Category:** Rule Signatures\ **Created:** [June 13, 2023, 8:17pm UTC](https://community.emergingthreats.net/t/risepro-tcp-v-0-1/647 "2023-06-13T20:17:28Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Post date:** [June 13, 2023, 8:17pm UTC](https://community.emergingthreats.net/t/risepro-tcp-v-0-1/647/1 "2023-06-13T20:17:29Z")
Hi, it’s me again! And here’s what I brought you. Few rules for RisePro, protocol is TCP in this version instead of HTTP. Maybe it’s just a setting, I don’t know yet there is no builder. Xor encryption is the same as HTTP is 0x36 - one byte. Look at my tweet, [https://twitter.com/Jane\_0sint/status/1667565169461919746?s=20](https://twitter.com/Jane_0sint/status/1667565169461919746?s=20) There I tried to combine commands with bytes from the protocol, I could have messed up, although it’s unlikely with a request to load the configuration and exfiltrate. And so here are the rules: ```auto alert tcp any any -> any any (msg: "ET MALWARE [ANY.RUN] RisePro (Token)";flow: established, to_client; stream_size: server, =, 37; dsize: 36; content: "|18 00 00 00 12 27 00 00|";offset: 4; depth: 8; classtype: command-and-control; reference:md5,a1f3423e231abd59d45b2ec37f751bbc; reference:url,app.any.run/tasks/d4c145cc-6a2d-4512-9cd6-555f0f2e17ed; metadata: attack_target Client_Endpoint, deployment Perimeter, former_category MALWARE, signature_severity Major, malware_family RisePro, created_at 2023_06_10; sid: 8000175; rev: 1;) alert tcp any any -> any any (msg: "ET MALWARE [ANY.RUN] RisePro (External IP)";flow: established, to_client; dsize: 19<>29; content: "|00 00 00 21 27 00 00|";offset: 5; depth: 8; classtype: command-and-control; reference:md5,a1f3423e231abd59d45b2ec37f751bbc; reference:url,app.any.run/tasks/d4c145cc-6a2d-4512-9cd6-555f0f2e17ed; metadata: attack_target Client_Endpoint, deployment Perimeter, former_category MALWARE, signature_severity Major, malware_family RisePro, created_at 2023_06_10; sid: 8000176; rev: 1;) alert tcp any any -> any any (msg: "ET MALWARE [ANY.RUN] RisePro (Get_settings)";flow: established, to_server; dsize: 13;content: "|01 00 00 00 18 27 00 00|";offset: 4; depth: 8; classtype: command-and-control;reference:md5,a1f3423e231abd59d45b2ec37f751bbc; reference:url,app.any.run/tasks/d4c145cc-6a2d-4512-9cd6-555f0f2e17ed; metadata: attack_target Client_Endpoint, deployment Perimeter, former_category MALWARE, signature_severity Major, malware_family RisePro, created_at 2023_06_10;sid: 8000177; rev: 1;) alert tcp any any -> any any (msg: "ET MALWARE [ANY.RUN] RisePro (Activity)";flow: established, to_server; dsize: 12;content: "|00 00 00 00 10 27 00 00|";offset: 4; depth: 8; classtype: command-and-control;reference:md5,a1f3423e231abd59d45b2ec37f751bbc; reference:url,app.any.run/tasks/d4c145cc-6a2d-4512-9cd6-555f0f2e17ed; metadata: attack_target Client_Endpoint, deployment Perimeter, former_category MALWARE, signature_severity Major, malware_family RisePro, created_at 2023_06_10;sid: 8000178; rev: 1;) alert tcp any any -> any any (msg: "ET MALWARE [ANY.RUN] RisePro (Exfiltration)";flow: established, to_server; dsize: >1100;content: "|00 1F 27 00 00|";offset: 7; depth: 5; classtype: command-and-control;reference:md5,a1f3423e231abd59d45b2ec37f751bbc; reference:url,app.any.run/tasks/d4c145cc-6a2d-4512-9cd6-555f0f2e17ed; metadata: attack_target Client_Endpoint, deployment Perimeter, former_category MALWARE, signature_severity Major, malware_family RisePro, created_at 2023_06_10;sid: 8000179; rev: 1;) ``` And here are a couple of additional links to samples: > [Automated Malware Analysis Report for file.exe - Generated by Joe Sandbox](https://www.joesandbox.com/analysis/885493/0/html) > [Automated Malware Analysis Report for file.exe - Generated by Joe Sandbox](https://www.joesandbox.com/analysis/884821/0/html) _Have a nice day, regards Jane._ ---
**Author:** ![trobinson667](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/trobinson667/32/544_2.png) [@trobinson667](https://community.emergingthreats.net/u/trobinson667)\ **Post date:** [June 14, 2023, 7:31pm UTC](https://community.emergingthreats.net/t/risepro-tcp-v-0-1/647/2 "2023-06-14T19:31:05Z")
Hello again! and thank you very much for your contribution to the ET ruleset. I’ve looked over the rules you provided and aside from some minor cosmetic/style changes, (e.g. spacing of options, using HOME and EXTERNAL\_NET vars) nothing of substances requires modifying. Wonderful job! We will add these rules to the ETOPEN ruleset, and credit you for the assistance. Also, it looks like we have coverage for the HTTP version of RisePro, according to our Dalton instance. We ran the pcap from the The Risepro v.1.0 HTTP sample you provided and the following rules triggered: ```auto [1:2042982:1] ET MALWARE Win32/RisePro CnC Command Outbound (set_file) [1:2042983:1] ET MALWARE Win32/RisePro CnC Command Outbound (get_loaders) [1:2042984:1] ET MALWARE Win32/RisePro CnC Command Outbound (get_marks) [1:2042985:1] ET MALWARE Win32/RisePro CnC Command Outbound (freezeStats) [1:2042987:1] ET MALWARE Win32/RisePro CnC Command Outbound (pingmap) [1:2042989:1] ET MALWARE Win32/RisePro CnC Server Response M1 [1:2042990:1] ET MALWARE Win32/RisePro CnC Server Response M2 [1:2042991:1] ET MALWARE Win32/RisePro CnC Server Response M3 ``` Thanks for everything, and if there is anything else I can do for you, let me know. -Tony ---
**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Post date:** [June 14, 2023, 7:57pm UTC](https://community.emergingthreats.net/t/risepro-tcp-v-0-1/647/3 "2023-06-14T19:57:42Z")
Cool, I also use Dalton! And Risepro v.1.0 in open HTTP is well covered with rules, I used their sids to search for traffic in the database. Another challenge to cover encrypted HTTPS by packet length, it’s a pity this method is not quite suitable for highly loaded systems 😑 So we will use it in the sandbox 😉 Good luck! ---
**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Post date:** [August 15, 2023, 1:14pm UTC](https://community.emergingthreats.net/t/risepro-tcp-v-0-1/647/4 "2023-08-15T13:14:53Z")
Hi, I look at the contents of the information.txt file and see that the version of the stealer has been updated, but don’t worry)) because the rules continue to work. The current versions are 0.1 0.2 and 0.4 and now I propose to change the message a little. Perhaps something like ET MALWARE [ANY.RUN] RisePro TCP v.0.x ? Rule numbers 2046267 2046269 2046268 2046266 2046270 > **[Analysis 4155520471d9fc535e2c951d93e848cf.exe (MD5:...](https://app.any.run/tasks/0f29db77-3f4e-41d9-9814-d47cbba7ff05/)** > > Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary. ![image](https://us1.discourse-cdn.com/flex016/uploads/emergingthreats/original/1X/5928e4b1b17077a18e3e82052843cba41ab06f14.png) Have a nice day! Jane ---
**Author:** ![jtaylor](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jtaylor/32/12_2.png) [@jtaylor](https://community.emergingthreats.net/u/jtaylor)\ **Post date:** [August 17, 2023, 7:46pm UTC](https://community.emergingthreats.net/t/risepro-tcp-v-0-1/647/5 "2023-08-17T19:46:29Z")
> [@Jane0sint](#): > > Hi, I look at the contents of the information.txt file and see that the version of the stealer has been updated, but don’t worry)) because the rules continue to work. The current versions are 0.1 0.2 and 0.4 and now I propose to change the message a little. > Perhaps something like ET MALWARE [ANY.RUN] RisePro TCP v.0.x ? > Rule numbers 2046267 2046269 2046268 2046266 2046270 Thanks! We got those updated for todays release. JT ---
**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Post date:** [November 23, 2023, 5:31am UTC](https://community.emergingthreats.net/t/risepro-tcp-v-0-1/647/6 "2023-11-23T05:31:25Z")
Hi, I came to update the message in the rule. The release version RisePro has been released and now the note about version v.0.x is no longer relevant, I suggest removing it) ![image](https://us1.discourse-cdn.com/flex016/uploads/emergingthreats/original/1X/237cd68aca7699e4f1ba7060d86ae1ee363652e6.png) > **[Analysis file (MD5: 49859F9E7C479FBAB309267ABE6EAC80) Malicious activity -...](https://app.any.run/tasks/6fad09b6-35c6-4563-8e67-bfd3f7d08dd0/)** > > Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary. Have a nice day! Jane. ---
**Author:** ![jtaylor](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jtaylor/32/12_2.png) [@jtaylor](https://community.emergingthreats.net/u/jtaylor)\ **Post date:** [November 27, 2023, 1:25pm UTC](https://community.emergingthreats.net/t/risepro-tcp-v-0-1/647/7 "2023-11-27T13:25:22Z")
> [@Jane0sint](#): > > Hi, I came to update the message in the rule. The release version RisePro has been released and now the note about version v.0.x is no longer relevant, I suggest removing it) Thanks! Updated signature names will go out in todays release. JT ---
**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Post date:** [December 28, 2023, 7:14am UTC](https://community.emergingthreats.net/t/risepro-tcp-v-0-1/647/8 "2023-12-28T07:14:29Z")
Hi, can I please add a link to this discussion to the rules? Sorry I’ll have to send this message to all my threads 🙏 reference:url,[community.emergingthreats.net/t/risepro-tcp-v-0-1/](http://community.emergingthreats.net/t/risepro-tcp-v-0-1/); ---
**Author:** ![jtaylor](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jtaylor/32/12_2.png) [@jtaylor](https://community.emergingthreats.net/u/jtaylor)\ **Post date:** [December 28, 2023, 6:52pm UTC](https://community.emergingthreats.net/t/risepro-tcp-v-0-1/647/9 "2023-12-28T18:52:11Z")
Hi Jane, Updates to the reference in the signatures will go out today. Thanks for bringing this up! JT ---
**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Post date:** [January 9, 2024, 4:24pm UTC](https://community.emergingthreats.net/t/risepro-tcp-v-0-1/647/10 "2024-01-09T16:24:03Z")
I offer the following description for this threat: > RisePro is a malware-as-a-service info-stealer, first identified in 2022. It is distributed through fake cracks sites operated by the PrivateLoader pay-per-install (PPI) malware distribution service. It is designed to steal credit cards, passwords, and crypto wallets from infected devices. The current implementation of the stealer is built using its own protocol based on the TCP transport using custom encryption. The detected threat allows not only to steal client data but also to install remote control over it via HVNC. reference:url,any.run/cybersecurity-blog/risepro-malware-communication-analysis; This may not be the best description, but I suggest starting with this. Best regards, Jane. ---
**Author:** ![jtaylor](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jtaylor/32/12_2.png) [@jtaylor](https://community.emergingthreats.net/u/jtaylor)\ **Post date:** [January 9, 2024, 6:57pm UTC](https://community.emergingthreats.net/t/risepro-tcp-v-0-1/647/11 "2024-01-09T18:57:42Z")
Thanks Jane! We will get the updates out today. JT ---
**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Post date:** [January 10, 2024, 5:23am UTC](https://community.emergingthreats.net/t/risepro-tcp-v-0-1/647/12 "2024-01-10T05:23:25Z")
Sorry, I forgot to include the rule numbers: 2046266 2046268 2046270 - Any.run 2049660 2049060 2049661 - ET > **[Analysis 7a7126809eaa8ce5576ffd8d1caeed0dffaa34d41e7e435ccbfb382dbffc4ab5.exe...](https://app.any.run/tasks/30f98e9f-d9b2-41d1-ae46-88e3070ae662/)** > > Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary. ---
**Author:** ![jtaylor](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jtaylor/32/12_2.png) [@jtaylor](https://community.emergingthreats.net/u/jtaylor)\ **Post date:** [January 10, 2024, 12:24pm UTC](https://community.emergingthreats.net/t/risepro-tcp-v-0-1/647/13 "2024-01-10T12:24:06Z")
The Any.run sids were updated yesterday as well, I updated the ET ones for todays release. Thanks Jane! JT