ELASTIC Security Labs has documented four new modules linked to the REVSTEALER information stealer, which remain on an infected machine after the main payload deletes itself. The four programs—ProManager, WinUpdate, SoftManager and LockAppHost—deposit themselves into the user profile and persist there, unlike the core stealer which exfiltrates credentials and files and then self-destructs.
One of the modules, LockAppHost, is described as the most disruptive: it disables five Windows Update services, turns off 11 update tasks and two malware-removal tasks, excludes folders from Microsoft Defender, and then hides a crypto miner inside legitimate Windows processes after elevating privileges via CMSTP or a standard UAC prompt.
The other modules have distinct roles: ProManager overlays attacker content on wallet windows and steals wallet-related data; WinUpdate monitors the clipboard to swap cryptocurrency addresses and harvests potential wallet recovery phrases; SoftManager turns the machine into a reverse proxy for the attacker’s traffic.
Elastic notes the four modules share REVSTEALER’s build tradecraft, including the same packer, runtime resolution techniques, and even the use of Polygon smart contracts for backup configuration (EtherHiding). The core stealer’s capabilities include collecting browser passwords, cookies, wallets, gaming and messaging data, VPN/FTP configurations, and Browser App-Bound key material; it can also decrypt Roblox session data and retrieve Chrome’s App-Bound Encryption key.
Indicators of compromise include SHA-256 hashes for REVSTEALER and each module (adc4aa65..., 13d7237d..., 7c08cf40..., 14b2ac35..., c66d2b77...), and C2 domains monitor5.roast-core85[.]click, config.hubdisplay[.]lol, health.journal-metric[.]lol, and metric.gardenpark[.]click.
Responders are advised to re-enable Windows Update services, remove Defender exclusions added by LockAppHost, search for miner activity in suspended nslookup[.]exe or svchost[.]exe, and prompt affected users to change passwords and terminate active sessions where credentials or cookies were compromised. SOURCE_UNAVAILABLE