PrivateLoader as a RiseProStealer Dropper Technical Analysis

PrivateLoader is a malware dropper sold through a Pay-Per-Install service. A malware operator supplies a payload, a number of installations and target locations, and the service operator spreads it. This post analyses PrivateLoader and RiseProStealer, the information stealer it drops, with file fingerprints, the infection chain and mitigation steps.

This blog post comes from the “PrivateLoader as a RiseProStealer Dropper Technical Analysis Report” by the Brandefense Research Team. For more details about the analysis, download the report.

What Is PrivateLoader?

Cyber threats keep evolving, and Pay-Per-Install (PPI) malware services are a significant and lasting part of that picture. These services are deeply rooted in the cybercrime ecosystem. They have made it easier to earn money from malware installations, and they remain a persistent threat to digital security. This report looks at how such a service works, with a focus on the technical analysis of PrivateLoader, a notable player in this field.

Pay-Per-Install services follow a simple but effective business model. A malware operator gives the service operator a payload, a set number of installations and target locations. The service operator then distributes the malware to the customer’s specifications. This way of selling malware distribution simplifies the process for cybercriminals. It also widens the reach and impact of their activities. Low costs and easy access let malware operators use these services for wide, targeted and rapid deployment of many malware types.

This report gives a technical analysis of PrivateLoader. It covers how the malware operates, how it is distributed and what its activity means for the wider cybercrime ecosystem. By taking the malware apart, we aim to explain how it works. This helps in building more effective defenses against such threats.

PrivateLoader is the starting point for the distribution of many types of malware. Recently, the distribution of RiseProStealer, which was developed for information theft, has increased. For this reason, our report also includes an in-depth technical analysis of RiseProStealer. It is the final payload dropped on the target system, while PrivateLoader acts as the dropper.

The emergence of RisePro Stealer marks a step up in the capabilities of malware that targets digital assets and personal information. RisePro Stealer was identified in 2022. It quickly gained notoriety for its advanced mechanisms and its effectiveness at getting into systems and stealing sensitive data. Its rise shows the continuous innovation among cybercriminals and the growing challenges for security professionals.

Scope

Infection Chain

How Can You Defend Against This Malware?

• Keep all software, including operating systems and applications, up-to-date with the latest patches.
• Use web filters to block access to malicious websites.
• Consider using ad blockers to prevent malvertising attacks.
• Implement robust spam filters to prevent phishing emails from reaching users.
• Scan email attachments for malware before they can be opened.
• Train users to recognize and report suspicious emails.
• Use both hardware and software firewalls to monitor and control incoming and outgoing network traffic.
• Ensure that your antivirus software provides real-time scanning and threat detection.

Download YARA Rules and IoCs from Brandefense’s IoC repository on GitHub.

This blog post comes from the “PrivateLoader as a RiseProStealer Dropper Technical Analysis Report” by the Brandefense Research Team. For more details about the analysis, download the report.