Full Report
Elastic Security Labs has documented four previously unreported programs associated with REVSTEALER, an emerging Windows information stealer, that remain on an infected machine after the stealer deletes itself. One of them switches off Windows Update and Microsoft Defender before running a cryptocurrency miner. The company named the four programs ProManager, WinUpdate, SoftManager, and
Analysis Summary
# Tool/Technique: REVSTEALER and Associated Modules
## Overview
REVSTEALER is an emerging Windows-based commercial information stealer first observed in early 2026. It is designed to exfiltrate a wide array of credentials and data before self-deleting. It is associated with a specific "activity set" of four persistent modules (**ProManager, WinUpdate, SoftManager, and LockAppHost**) that remain on the system to perform long-term malicious activities such as cryptocurrency theft, proxying traffic, and cryptomining.
## Technical Details
- **Type:** Malware Family (Infostealer) and Modular Post-Exploitation Tools
- **Platform:** Windows
- **Capabilities:** Credential harvesting (browsers, crypto wallets, gaming), defense evasion (disabling Defender/Windows Update), clipboard manipulation, reverse proxying, and cryptomining.
- **First Seen:** February 2026
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- [T1555 - Credentials from Web Browsers]
- [T1539 - Steal Web Session Cookie]
- [T1552.001 - Credentials in Files]
- **[TA0005 - Defense Evasion]**
- [T1562.001 - Disable or Modify Tools] (Disabling Microsoft Defender)
- [T1218.003 - CMSTP] (UAC Bypass via Connection Manager Profile Installer)
- [T1070.004 - File Deletion] (Self-deletion of core stealer)
- **[TA0003 - Persistence]**
- [T1547.001 - Registry Run Keys / Startup Folder]
- [T1053.005 - Scheduled Task]
- [T1037.001 - Logon Scripts]
- **[TA0009 - Collection]**
- [T1115 - Clipboard Data]
- [T1056.001 - Keylogging]
## Functionality
### Core Capabilities (REVSTEALER)
* **Information Theft:** Exfiltrates browser passwords/cookies, 50+ crypto wallet files, Telegram sessions, VPN/FTP configs, and Windows Credential Manager data.
* **Gaming Account Takeover:** Decrypts Roblox session cookies and targets gaming platform data.
* **Advanced Extraction:** Uses a debugger to bypass Chrome's App-Bound Encryption by reading decryption keys directly from memory (ElevationKatz technique).
* **Anti-Forensics:** Reports "complete" to the C2 and deletes its own executable to leave no trace.
### Advanced Features (Associated Modules)
* **ProManager:** Monitors Electron-based wallet applications; overlays attacker-controlled UI to trick users and logs passwords/passphrases.
* **WinUpdate:** A clipboard hijacker that replaces crypto addresses and scrapes for recovery mnemonics.
* **SoftManager:** Converts the infected host into a **Reverse Proxy** to route attacker traffic through the victim’s network.
* **LockAppHost:** Disables 5 Windows Update services and 13 scheduled tasks. It excludes common folders from Microsoft Defender before deploying a miner hidden in legitimate processes.
## Indicators of Compromise
* **File Names:** `ProManager.exe`, `WinUpdate.exe`, `SoftManager.exe`, `LockAppHost.exe`
* **Registry Keys:**
* `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` (Used by all four modules)
* **Behavioral Indicators:**
* Execution of `cmstp.exe` for unexpected UAC elevation.
* Modification of Microsoft Defender exclusion lists.
* Unexpected disabling of `wuauserv` (Windows Update) and related services.
* Network traffic associated with Polygon smart contracts (used for backup C2 configuration).
## Associated Threat Actors
* Currently categorized as a **commercial malware** offering; specific attribution to a named APT group is not yet established.
## Detection Methods
* **Signature-based:** Detection for the shared packer and runtime function resolution code used across all four modules.
* **Behavioral:**
* Monitoring for processes attempting to attach a debugger to Chrome (T1539).
* Alerting on modifications to Defender exclusion paths or Windows Update service states.
* Detecting UI overlays on known cryptocurrency wallet application coordinates.
* **Infrastructure:** Monitoring for traffic interacting with Polygon smart contract addresses used for C2 recovery.
## Mitigation Strategies
* **Endpoint Hardening:** Implement Attack Surface Reduction (ASR) rules to block process creations from Office/Web communication tools.
* **Privilege Management:** Restrict administrative rights to prevent `LockAppHost` from disabling security services.
* **Policy:** Enable Tamper Protection in Microsoft Defender to prevent unauthorized modification of security settings.
* **Monitoring:** Audit Scheduled Task creation and Registry Run key modifications in user profiles.
## Related Tools/Techniques
* **ElevationKatz:** Source of the Chrome App-Bound Encryption bypass technique.
* **VoidStealer:** Another information stealer observed using similar memory-reading techniques in early 2026.