Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Elastic Security Labs has documented four previously unreported programs associated with REVSTEALER, an emerging Windows information stealer, that remain on an infected machine after the stealer deletes itself.

One of them switches off Windows Update and Microsoft Defender before running a cryptocurrency miner.

The company named the four programs ProManager, WinUpdate, SoftManager, and LockAppHost and published the findings on September 2, along with a technical white paper. REVSTEALER has been sold as a commercial infostealer since at least February 2026, when the earliest sample was first detected on VirusTotal.

The core stealer exfiltrates browser passwords and cookies, cryptocurrency wallets, gaming accounts, messaging data, and files, then reports "complete" to its server, deletes itself, and leaves no persistence. The four newly documented programs work differently. Each installs itself into the user's profile and stays there.

Elastic recovered the four programs from the same investigation as REVSTEALER and found that they share its build tradecraft, including the same packer, runtime function resolution, and the use of Polygon smart contracts for backup configuration.

The core stealer can also download and run additional executables at the command line. Elastic did not report seeing any of the four delivered onto a live REVSTEALER host, so the connection rests on shared code and investigative context rather than an observed hand-off.

The company describes the components as an "activity set" and notes they are separate executables, not plug-ins loaded into the stealer itself.

What each program does, in Elastic's account:

ProManager	Steals wallet files and browser wallet extensions, displays attacker-controlled content over a wallet application's window, and logs passwords typed or pasted into fields it identifies as password or passphrase inputs	Registry Run key
WinUpdate	Watches the clipboard, replaces copied cryptocurrency addresses with the attacker's, and collects text that looks like a wallet recovery phrase	Scheduled task, with a Registry Run key as fallback
SoftManager	Turns the machine into a reverse proxy that routes the attacker's network traffic through the victim's connection	Logon script, scheduled task, or Registry Run key
LockAppHost	Runs a cryptocurrency miner with administrator rights after disabling Windows Update and excluding folders from Microsoft Defender	Registry Run key or a service

LockAppHost is the most disruptive of the four. To gain administrator rights, it abuses the Windows CMSTP tool, falling back to a standard elevation prompt if that fails.

Once elevated, it adds Microsoft Defender exclusions for common folders and file types, disables 5 Windows Update services, disables 11 scheduled update tasks and 2 malware removal tasks, and then hides a miner within legitimate Windows processes. The changes it makes to weaken the machine's defenses remain after the miner is found.

ProManager targets users of desktop cryptocurrency wallets. Because most of those wallets are built with the Electron framework, ProManager reads the wallet window's saved position and opens attacker-supplied content sized and positioned to overlay the real wallet, without touching the wallet program itself.

A separate part of the module records what the user types into password and passphrase fields, including values pasted from the clipboard.

Before the modules ever arrive, REVSTEALER casts a wide net. It collects browser passwords and cookies; files from more than 50 cryptocurrency wallets and a large set of wallet browser extensions; session data from Telegram and other messaging clients; VPN and FTP configuration; the Windows Credential Manager; password managers; and selected documents.

For some gaming platforms, it goes further. It decrypts the stored Roblox session cookie, allowing an attacker to take over the account without the password.

To obtain credentials that Chrome protects with App-Bound Encryption, REVSTEALER launches the browser in a debugger and reads the decryption key from memory. This is not a new technique, nor is it unique to REVSTEALER.

Elastic said it was likely adapted from the public ElevationKatz project and was also used by another stealer, VoidStealer, in March 2026. Gen Digital, which analyzed VoidStealer, described it as the first infostealer seen using the technique in the wild.

REVSTEALER reaches victims mainly through game-cheat lures. Elastic identified at least 17 YouTube channels, many of which were hijacked from their original owners, that promoted two cheat websites using short AI-generated videos.

The malware has also been packaged as pirated or impersonated software, including a fake "Claude Opus 5 Free Desktop" application that Morphisec documented on August 31. That application copied Anthropic's branding, and there is no indication Anthropic itself was compromised. Elastic's detection rule matched about 4,700 samples on VirusTotal over the past year, a count of files rather than confirmed infections.

REVSTEALER is built to resist analysis. It scores the machine against 10 sandbox checks and stops if the total is too high, and it terminates on systems set to one of 10 languages used across Russia and Central Asia.

It resolves Windows functions without a normal import table and calls the kernel via indirect system calls to bypass the hooks installed by security products. If its main command server is unreachable, it reads a backup address from a smart contract on the Polygon blockchain, a takedown-resistant method known as EtherHiding.

Unpacked builds also show a verification window that asks for a random six-character code before running, a gate against automated analysis that Elastic compares to Lumma Stealer and AuraStealer.

To reduce the risk of infection, avoid downloading "free" or unofficial versions of paid AI tools and game cheats, and install Claude only from Anthropic's official channels.

Elastic has published YARA rules and behavior rules and a set of indicators for detection and blocking. The public YARA file covers the core stealer and the ProManager, SoftManager, and WinUpdate modules, but does not include a rule for LockAppHost, the mining module.

Because the core stealer deletes itself, an infection can appear complete while the modules continue running. Where LockAppHost has run, responders should re-enable the Windows Update services and scheduled tasks that it turned off, remove the Microsoft Defender exclusions it added, and look for a miner hidden in a suspended instance of nslookup.exe or svchost.exe.

Since the stealer takes session cookies and the Chrome App-Bound Encryption key, affected users should change passwords and end active sessions on their accounts rather than assume a password reset is enough.

Selected indicators of compromise:

• SHA-256: adc4aa652965396b52e79435ca54987ae9eb21bf5e67de5e9461b09655165ee4 (REVSTEALER)
• SHA-256: 13d7237d7289e67c2d806a65d52580b453ce4987acbe2c4c4d04833f55ebccfa (ProManager)
• SHA-256: 7c08cf409194056a8517865e5d3433d1499bb8262263b55b49b8b07d9d182fcb (WinUpdate)
• SHA-256: 14b2ac356ed75d10ef40bbaaa48e7dd9fff7de9719c2a43ad123fe843dd4e4e2 (SoftManager)
• SHA-256: c66d2b77b9e85c53391891212413ad9a99eb66f4b11c6a431e78884a5b2651e5 (LockAppHost)
• Domain: monitor5.roast-core85[.]click (REVSTEALER C2)
• Domain: config.hubdisplay[.]lol (ProManager C2)
• Domain: health.journal-metric[.]lol (WinUpdate C2)
• Domain: metric.gardenpark[.]click (SoftManager C2)

Gen Threat Labs first documented REVSTEALER in July. Elastic's report and white paper are the fuller public account of the malware to date.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.