top of page

REVSTEALER: Self-Deleting Infostealer Linked to Persistent Modules That Disable Windows Defender for Cryptomining

September 11th, 2026

High

Our Cyber Threat Intelligence Unit is tracking REVSTEALER, an emerging Windows information stealer that harvests browser credentials, cryptocurrency wallets, and gaming account data. Gen Threat Labs first documented REVSTEALER in July 2026. On September 2, 2026, Elastic Security Labs published a deep dive identifying four previously unreported programs, ProManager, WinUpdate, SoftManager, and LockAppHost, that remain installed on a compromised host after the core stealer self-deletes. Elastic links these four programs to REVSTEALER based on shared build tradecraft and investigative context; it has not observed a live delivery chain from the core stealer to these modules. The malware is distributed through hijacked YouTube channels advertising game cheats and through installers impersonating legitimate software such as Slack, qBittorrent, Blender, and SteelSeries GG. Because the core stealer self-deletes after exfiltration, an infection can appear resolved while the linked modules remain active, disabling Windows Update and Microsoft Defender and deploying a cryptocurrency miner. Organizations of any size or sector that allow unmanaged software installation are at risk.

Technical Details

  • Threat Name: REVSTEALER (REF2859); modules assessed as linked: ProManager, WinUpdate, SoftManager, LockAppHost.

  • Severity: High

    • No CVE or CVSS score applies.

  • Affected Systems: Windows endpoints, all versions; systems set to CIS-region languages or keyboard layouts are excluded by the malware at runtime.

  • Malware Type: VMProtect-packed information stealer with a self-deleting core; four additional modules assessed as linked via shared build tradecraft and Polygon-based configuration, not confirmed via observed C2 tasking.

  • Threat Actor: Not publicly attributed; REVSTEALER has been sold as a commercial infostealer since at least February 2026.

  • Delivery Method: Hijacked YouTube channels promoting game cheats (elitecheatsx[.]live, resight-cheats[.]net); fake installers impersonating Slack, qBittorrent, SteelSeries GG, Blender, and AI tools.


Attack Chain Overview:

  • Initial Access and Evasion:

    • Victim runs a malicious installer via a cheat lure or fake software.

    • REVSTEALER runs ten sandbox checks and self-terminates at a score of 7 or higher, excludes CIS locales via FNV-1a hashing of language and keyboard-layout values, and uses indirect syscalls to bypass user-mode security hooks.

  • Credential Harvesting and Exfiltration:

    • Collects browser passwords and cookies, 225 Chromium wallet-extension IDs, 51 standalone wallet apps, gaming sessions (Steam, Roblox, Battle.net, EA Desktop, Minecraft, Battlestate Games), VPN and FTP configurations, and selected documents.

    • Bypasses Chrome App-Bound Encryption via debugger-based memory extraction. Exfiltrates all data to its C2 server,then self-deletes.

  • C2 Resilience via Blockchain:

    • If the primary C2 is unreachable, REVSTEALER queries up to five public Polygon JSON-RPC endpoints and decrypts a fallback C2 address from a smart contract using an embedded AES key (a technique known as EtherHiding).

    • The confirmed contract addresses differ by sample, and each contract resolves to an attacker-replaceable fallback address independent of the malware binary.

    • Domain- or contract-level blocking alone will not fully contain the campaign; see Detection Methods.

  • Modules Assessed as Linked to REVSTEALER:

    • Elastic recovered four additional programs from the same investigation that share REVSTEALER's build tradecraft (packer, runtime function resolution, and Polygon-based configuration):

      • ProManager (wallet-file and browser-extension theft, phishing overlays over wallet application windows, password-field input capture, and payload delivery)

      • WinUpdate (clipboard cryptocurrency-address hijacking and mnemonic-phrase theft)

      • SoftManager (reverse SOCKS5 proxy over an encrypted WebSocket connection)

      • LockAppHost (XMRig deployment, Windows Update and Microsoft Defender disabling, and a miner hidden inside nslookup.exe or svchost.exe).

    • No live delivery chain from the core stealer to these four modules has been directly observed.

Image by ThisisEngineering

Impact

  • Self-Deleting Core Conceals Ongoing Compromise: The core stealer's self-deletion after exfiltration means an infection appears resolved while linked modules remain active and persistent, creating a false sense of remediation.

  • Credential and Session Theft Allowing Account Takeover: Browser passwords, session cookies, and Chrome App-Bound Encryption keys are exfiltrated before deletion, allowing account takeover on any platform where the victim was authenticated. A password reset alone is insufficient without also invalidating active sessions.

  • Financial Exposure via Crypto Theft and Clipboard Hijacking: Direct financial loss results from wallet-file and extension theft (ProManager), clipboard address replacement (WinUpdate), and mnemonic recovery-phrase capture (WinUpdate), giving the attacker multiple concurrent paths to drain cryptocurrency holdings.

  • Defense Degradation via LockAppHost: Where LockAppHost is deployed, Windows Update and Microsoft Defender are persistently disabled, and Defender exclusions are added. These changes remain even after the miner itself is found and removed, leaving the host exposed to subsequent threats.

  • Infrastructure Abuse via SoftManager: SoftManager's reverse SOCKS5 proxy turns the compromised host into attacker relay infrastructure, extending risk beyond the original victim to any target the attacker routes through it.

  • Resilient Infrastructure via Polygon Dead Drop: Domain-level takedowns and DNS blocking of primary C2 servers do not terminate active infections; the malware can recover its C2 address from the blockchain autonomously, and the resolved address can be changed independent of the binary.

  • Broad, Unattributed Distribution: No sector-specific targeting has been confirmed. Any organization or individual permitting unmanaged software downloads or browser-extension installs is within scope of this campaign.

Detection Method

  • Deploy Elastic's published YARA rule (Windows.Trojan.RevStealer.yar) across endpoint tooling to detect the core stealer and the ProManager, SoftManager, and WinUpdate modules.

    • No YARA rule for LockAppHost is currently included in the public release.

  • Alert on DNS queries or network connections to the C2 domains listed below and to public Polygon JSON-RPC endpoints in general, which may indicate active C2 fallback resolution.

    • Because REVSTEALER's dead-drop design allows the attacker to change the resolved fallback address independent of the binary, treat this as a durability gap: prioritize the behavioral and YARA detections below over static domain or contract blocking for long-term coverage.

  • Monitor for shellcode execution from low-reputation modules and VirtualAlloc API calls from unsigned DLLs, using Elastic's published prevention rules.

  • Flag hardware-breakpoint-based evasion and remote thread context manipulation, both published Elastic prevention rules directly applicable to REVSTEALER's App-Bound Encryption bypass technique.

  • Alert on Chrome or Edge processes spawned from unusual parent processes, a credential-access indicator consistent with REVSTEALER's debugger-based key extraction method.

  • Monitor for unexpected disabling of Windows Update-related services and scheduled tasks, or creation of Microsoft Defender exclusions for common folders or file types.

    • Elastic reports LockAppHost disables five Windows Update services along with eleven scheduled update tasks and two malware-removal tasks; exact service names have not been published.

  • Inspect outbound network traffic and process behavior for connections from nslookup.exe or svchost.exe to external infrastructure, or for a suspended instance of either process that cannot be correlated to legitimate activity, indicating the LockAppHost miner may be hidden within them.

  • Review clipboard-monitoring and scheduled-task creation events for activity from processes in the user profile directory not associated with approved software, consistent with WinUpdate and SoftManager persistence mechanisms.

Indicators of Compromise

Type

Indicator

Description

SHA-256

4c897108e8e793d6904110928c996815c302d6975c9bc61162149e855a963d50

resightloader.exe (REVSTEALER loader)

SHA-256

adc4aa652965396b52e79435ca54987ae9eb21bf5e67de5e9461b09655165ee4

REVSTEALER core stealer

SHA-256

13d7237d7289e67c2d806a65d52580b453ce4987acbe2c4c4d04833f55ebccfa

ProManagerServicedc894.exe (ProManager)

SHA-256

7c08cf409194056a8517865e5d3433d1499bb8262263b55b49b8b07d9d182fcb

WinUpdate60e3a3.exe (WinUpdate)

SHA-256

14b2ac356ed75d10ef40bbaaa48e7dd9fff7de9719c2a43ad123fe843dd4e4e2

SoftManager72fb40.exe (SoftManager)

SHA-256

c66d2b77b9e85c53391891212413ad9a99eb66f4b11c6a431e78884a5b2651e5

LockAppHost14a02b.exe (LockAppHost)

Domain

monitor5.roast-core85[.]click

REVSTEALER core C2

Domain

config.hubdisplay[.]lol

ProManager C2

Domain

health.journal-metric[.]lol

WinUpdate C2

Domain

metric.gardenpark[.]click

SoftManager C2

Wallet Address

0x98FF8e7cdC13AE46b83B7590B986F25f1560DF03

ProManager Polygon dead-drop contract

Wallet Address

0x0cF1Ec8B9551103de729c3b02D77221Da9d81Acc

WinUpdate Polygon dead-drop contract

Wallet Address

0x0E04c59f31E382D2B8A1637f4B9A5f04165EC48d

SoftManager Polygon dead-drop contract

Wallet Address

0xC4eC9B7be1c2A0B39Eca678673DcB9164CA5df53

LockAppHost Polygon dead-drop contract


mix of red, purple, orange, blue bubble shape waves horizontal for cybersecurity and netwo

Recommendations

  • Deploy Elastic's published YARA and behavior rules across endpoint tooling immediately. The full IOC set is available at github.com/elastic/labs-releases/tree/main/indicators/revstealer.

  • Restrict unmanaged software downloads and browser-extension installs; enforce application allowlisting where feasible, since informal software installs and unofficial sources are the malware's primary delivery paths.

  • Rotate all passwords and terminate active browser sessions for any user on a host where REVSTEALER activity is confirmed.

    • Session-cookie theft means a password reset alone does not revoke attacker access to authenticated sessions.

  • Isolate and rebuild hosts where LockAppHost activity is confirmed: re-enable all Windows Update services and scheduled tasks, remove added Microsoft Defender exclusions, and verify no suspended miner instance remains in nslookup.exe or svchost.exe before restoring from a verified clean backup.

  • Block the listed C2 domains at DNS and network perimeter controls, and treat Polygon-based C2 resolution as a detection priority rather than a blocking problem, since contract-level blocking alone is insufficient given the dead-drop fallback design.

  • Block or alert on downloads from elitecheatsx[.]live and resight-cheats[.]net at the web proxy and DNS layer, and flag historical connections to these domains as potential retroactive infection indicators.

  • Educate users to avoid downloading game cheats, cracked software, or unofficial versions of paid tools from any source, including YouTube video links, as this is the primary social-engineering vector behind this campaign.

Conclusion

Four newly documented modules, assessed as linked to REVSTEALER, significantly extend what begins as a credential-theft campaign into persistent defense evasion, cryptomining, clipboard hijacking, and proxy-infrastructure abuse, though Elastic has not observed a live delivery chain confirming that link. The core stealer's self-deletion is a deliberate design choice that exploits responders' tendency to declare an incident resolved once the initial binary is gone, while the linked modules continue operating undetected. Using Polygon smart contracts as a blockchain-based dead drop for C2 recovery renders infrastructure takedowns an incomplete mitigation, since the resolved address is attacker-replaceable regardless of the binary. We urge organizations to treat any REVSTEALER detection as a presumed multi-stage infection, forensically verify for all four linked modules, and apply Elastic's full detection artifact set rather than relying on the absence of the core binary as confirmation of a clean environment.

bottom of page