Hackers Utilizing Cracked Software program on GitHub to Unfold RisePro Information Stealer

Cracked Software on GitHub

Cybersecurity researchers have discovered a variety of GitHub repositories providing cracked software program which might be used to ship an data stealer known as RisePro.

The marketing campaign, codenamed gitgub, consists of 17 repositories related to 11 totally different accounts, based on G DATA. The repositories in query have since been taken down by the Microsoft-owned subsidiary.

“The repositories look comparable, that includes a README.md file with the promise of free cracked software program,” the German cybersecurity firm said.

“Inexperienced and crimson circles are generally used on Github to show the standing of computerized builds. Gitgub menace actors added 4 inexperienced Unicode circles to their README.md that fake to show a standing alongside a present date and supply a way of legitimacy and recency.”


The record of repositories is as follows, with every of them pointing to a obtain hyperlink (“digitalxnetwork[.]com”) containing a RAR archive file –

  • andreastanaj/AVAST
  • andreastanaj/Sound-Booster
  • aymenkort1990/fabfilter
  • BenWebsite/-IObit-Good-Defrag-Crack
  • Faharnaqvi/VueScan-Crack
  • javisolis123/Voicemod
  • lolusuary/AOMEI-Backupper
  • lolusuary/Daemon-Instruments
  • lolusuary/EaseUS-Partition-Grasp
  • lolusuary/SOOTHE-2
  • mostofakamaljoy/ccleaner
  • rik0v/ManyCam
  • Roccinhu/Tenorshare-Reiboot
  • Roccinhu/Tenorshare-iCareFone
  • True-Oblivion/AOMEI-Partition-Assistant
  • vaibhavshiledar/droidkit
  • vaibhavshiledar/TOON-BOOM-HARMONY

The RAR archive, which requires the victims to produce a password talked about within the repository’s README.md file, incorporates an installer file, which unpacks the next-stage payload, an executable file that is inflated to 699 MB in an effort to crash evaluation instruments like IDA Professional.

The precise contents of the file – amounting to a mere 3.43 MB – act as a loader to inject RisePro (model 1.6) into both AppLaunch.exe or RegAsm.exe.

RisePro burst into the highlight in late 2022 when it was distributed utilizing a pay-per-install (PPI) malware downloader service often called PrivateLoader.


Written in C++, it is designed to collect delicate data from contaminated hosts and exfiltrate it to 2 Telegram channels, which are sometimes utilized by menace actors to extract victims’ knowledge. Apparently, current analysis from Checkmarx showed that it is potential to infiltrate and ahead messages from an attacker’s bot to a different Telegram account.

The event comes as Splunk detailed the techniques and methods adopted by Snake Keylogger, describing it as a stealer malware that “employs a multifaceted strategy to knowledge exfiltration.”

“Using FTP facilitates the safe switch of recordsdata, whereas SMTP allows the sending of emails containing delicate data,” Splunk said. “Moreover, integration with Telegram presents a real-time communication platform, permitting for rapid transmission of stolen knowledge.”

Stealer malware have change into more and more widespread, usually changing into the first vector for ransomware and different excessive impression knowledge breaches. In line with a report from Specops printed this week, RedLine, Vidar, and Raccoon have emerged as probably the most widely-used stealers, with RedLine alone accounting for the theft of greater than 170.3 million passwords within the final six months.

“The present rise of information-stealing malware is a stark reminder of regularly evolving digital threats,” Flashpoint noted in January 2024. “Whereas the motivations behind its use is sort of all the time rooted in monetary acquire, stealers are frequently adapting whereas being extra accessible and simpler to make use of.”

Notify of
Inline Feedbacks
View all comments
Previous Post
Chrome Extension Tool For OSINT & Recon

Chrome Extension Device For OSINT & Recon

Next Post
Allow Exporting The Information Downloaded With Sqlmap To A Relational Database Like Postgres And Sqlite

Enable Exporting The Info Downloaded With Sqlmap To A Relational Database Like Postgres And Sqlite

Related Posts