Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Elastic Security Labs identified four malicious modules—ProManager, WinUpdate, SoftManager, and LockAppHost—linked to the REVSTEALER information stealer. These modules persist on infected systems after the main stealer deletes itself and perform various malicious activities, including cryptocurrency wallet theft, clipboard manipulation, reverse proxy setup, and cryptocurrency mining. LockAppHost disables Windows Update and Microsoft Defender to run a miner with elevated privileges, weakening system defenses. The modules share code and infrastructure with REVSTEALER, including use of Polygon blockchain for C2 resiliency and common packer techniques.

AI-extracted · verify before operational use