Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Elastic Security Labs has documented four previously unreported programs associated with REVSTEALER, an emerging Windows information stealer, that remain on an infected machine after the stealer deletes itself. One of these programs, LockAppHost, is particularly disruptive, abusing the Windows CMSTP tool to gain administrator rights and then disabling critical Windows Update services and Microsoft Defender exclusions to install a cryptocurrency miner. The other programs – ProManager, WinUpdate, and SoftManager – each have their own specific functions, such as targeting cryptocurrency wallets, disabling Windows Update, and managing user profiles, respectively.

Each of these programs installs itself into the user's profile and stays there, even after the core stealer has been removed. Elastic recovered the four programs from the same investigation as REVSTEALER and found that they share its build tradecraft, including the same packer, runtime function resolution, and the use of Polygon smart contracts for backup configuration. The core stealer can also download and run additional executables at the command line.

LockAppHost is the most disruptive, utilizing Windows CMSTP to gain admin rights and then disabling Windows Update and Defender. ProManager targets desktop cryptocurrency wallets by overlaying attacker-supplied content onto wallet windows and recording user input. WinUpdate disables Windows Update services and scheduled tasks, while SoftManager manages user profiles.

REVSTEALER reaches victims mainly through game-cheat lures. Elastic identified at least 17 YouTube channels, many of which were hijacked from their original owners, that promoted two cheat websites using short AI-generated videos. The malware has also been packaged as pirated or impersonated software, including a fake "Claude Opus 5 Free Desktop" application that Morphisec documented on August 31. Gen Digital described VoidStealer, another stealer using a similar technique, as the first to use this method in the wild.

REVSTEALER is built to resist analysis, scoring the machine against 10 sandbox checks and terminating if the total score is too high. It also terminates on systems set to one of 10 languages used across Russia and Central Asia. The stealer resolves Windows functions without a normal import table and calls the kernel via indirect system calls to bypass security product hooks. If its main command server is unreachable, it reads a backup address from a smart contract on the Polygon blockchain, a takedown-resistant method. Unpacked builds also show a verification window that asks for a random six-character code before running, a gate against automated analysis.

To reduce the risk of infection, avoid downloading "free" or unofficial versions of paid AI tools and game cheats, and install Claude only from Anthropic's official channels. Elastic has published YARA rules and behavior rules and a set of indicators for detection and blocking. The public YARA file covers the core stealer and the ProManager, SoftManager, and WinUpdate modules, but does not include a rule for LockAppHost, the mining module.

Because the core stealer deletes itself, an infection can appear complete while the modules continue running. Where LockAppHost has run, responders should re-enable the Windows Update services and scheduled tasks that it turned off, remove the Microsoft Defender exclusions it added, and look for a miner hidden in a suspended instance of nslookup.exe or svchost.exe. Since the stealer takes session cookies and the Chrome App-Bound Encryption key, affected users should change passwords and end active sessions on their accounts rather than assume a password reset is enough.