Elastic Security Labs has unveiled a suite of four previously undocumented programs linked to REVSTEALER, a rising Windows information stealer that intriguingly persists on infected machines even after the main stealer self-deletes. This revelation was shared on September 2, alongside a comprehensive technical white paper.
Details of the Programs
The four newly identified programs, dubbed ProManager, WinUpdate, SoftManager, and LockAppHost, exhibit distinct functionalities that set them apart from the core stealer. Notably, one of these programs disables Windows Update and Microsoft Defender before initiating a cryptocurrency mining operation.
REVSTEALER has been marketed as a commercial infostealer since at least February 2026, with its earliest sample detected on VirusTotal. The primary function of this stealer is to exfiltrate sensitive data, including browser passwords, cookies, cryptocurrency wallet information, gaming accounts, and messaging data. After reporting its activities as “complete” to its server, it deletes itself, leaving no trace of persistence. In contrast, the four newly documented programs install themselves within the user’s profile, ensuring their continued presence.
Elastic’s investigation revealed that these programs share the same build tradecraft as REVSTEALER, employing identical packers, runtime function resolutions, and utilizing Polygon smart contracts for backup configurations. While the core stealer is capable of downloading and executing additional executables via the command line, Elastic has yet to observe any of the four programs being deployed on active REVSTEALER hosts. Thus, the connection is inferred from shared code and investigative context rather than direct observation.
Functionality Breakdown
The functionality of each program is as follows:
| ProManager | Steals wallet files and browser wallet extensions, displays attacker-controlled content over a wallet application’s window, and logs passwords typed or pasted into fields it identifies as password or passphrase inputs. | Registry Run key |
| WinUpdate | Monitors the clipboard, replaces copied cryptocurrency addresses with those of the attacker, and collects text resembling wallet recovery phrases. | Scheduled task, with a Registry Run key as fallback |
| SoftManager | Transforms the machine into a reverse proxy, routing the attacker’s network traffic through the victim’s connection. | Logon script, scheduled task, or Registry Run key |
| LockAppHost | Executes a cryptocurrency miner with administrator rights after disabling Windows Update and excluding folders from Microsoft Defender. | Registry Run key or a service |
Among these, LockAppHost stands out as the most disruptive. It exploits the Windows CMSTP tool to gain administrator rights, reverting to a standard elevation prompt if necessary. Once elevated, it disables multiple Windows Update services and scheduled tasks, adds exclusions for common folders in Microsoft Defender, and conceals a miner within legitimate Windows processes. The modifications it makes to the system’s defenses persist even after the miner is detected.
ProManager specifically targets users of desktop cryptocurrency wallets, leveraging the Electron framework to overlay attacker-supplied content over the real wallet interface without altering the wallet application itself. Additionally, it captures user inputs in password fields, including pasted values.
Before these modules are introduced, REVSTEALER casts a wide net, gathering browser passwords, cookies, files from over 50 cryptocurrency wallets, session data from messaging clients like Telegram, and various configuration files. Notably, it can decrypt stored Roblox session cookies, enabling account takeovers without requiring passwords.
To extract credentials protected by Chrome’s App-Bound Encryption, REVSTEALER employs a debugger to access the decryption key from memory—a method not unique to this stealer but likely adapted from the public ElevationKatz project, previously utilized by another stealer, VoidStealer.
Distribution and Evasion Techniques
REVSTEALER primarily reaches its victims through game-cheat lures, with Elastic identifying at least 17 YouTube channels promoting cheat websites via short AI-generated videos. The malware has also been disguised as pirated or impersonated software, including a counterfeit application mimicking Anthropic’s branding.
Designed to resist analysis, REVSTEALER employs multiple evasion techniques, including scoring the machine against ten sandbox checks and terminating on systems set to specific languages. It circumvents security products by resolving Windows functions without a standard import table and using indirect system calls to access the kernel. In cases where the main command server is unreachable, it retrieves a backup address from a smart contract on the Polygon blockchain, a method known as EtherHiding.
To mitigate the risk of infection, users are advised to refrain from downloading unofficial versions of paid AI tools and game cheats. Elastic has released YARA rules and behavioral indicators for detection and blocking, although the mining module LockAppHost lacks a specific detection rule.
In instances of infection, it is crucial to re-enable the Windows Update services and scheduled tasks disabled by LockAppHost, remove the exclusions added to Microsoft Defender, and search for hidden miners within system processes. Affected users should change their passwords and terminate active sessions on their accounts, as the stealer’s capabilities extend beyond mere password resets.
Indicators of Compromise
- SHA-256: adc4aa652965396b52e79435ca54987ae9eb21bf5e67de5e9461b09655165ee4 (REVSTEALER)
- SHA-256: 13d7237d7289e67c2d806a65d52580b453ce4987acbe2c4c4d04833f55ebccfa (ProManager)
- SHA-256: 7c08cf409194056a8517865e5d3433d1499bb8262263b55b49b8b07d9d182fcb (WinUpdate)
- SHA-256: 14b2ac356ed75d10ef40bbaaa48e7dd9fff7de9719c2a43ad123fe843dd4e4e2 (SoftManager)
- SHA-256: c66d2b77b9e85c53391891212413ad9a99eb66f4b11c6a431e78884a5b2651e5 (LockAppHost)
- Domain: monitor5.roast-core85[.]click (REVSTEALER C2)
- Domain: config.hubdisplay[.]lol (ProManager C2)
- Domain: health.journal-metric[.]lol (WinUpdate C2)
- Domain: metric.gardenpark[.]click (SoftManager C2)
Gen Threat Labs first documented REVSTEALER in July, and Elastic’s recent report, along with the accompanying white paper, provides the most comprehensive public account of this malware to date.
