Inside REVSTEALER's Growing Distribution Ecosystem

Executive Summary

REVSTEALER is an emerging infostealer that has rapidly evolved into a sophisticated, multi-vector threat targeting gamers, content creators, and general users through deceptive software distribution. This research examines the full spectrum of REVSTEALER's operations, from its sprawling distribution infrastructure spanning over 100 domains to its advanced anti-analysis techniques, credential harvesting capabilities, and blockchain-based command-and-control resilience.

Our investigation reveals a threat actor employing industrial-scale distribution tactics through gaming cheats, fake AI tools, and trojanized legitimate software. REVSTEALER demonstrates nation-state-level tradecraft including AES-256 encryption, indirect syscalls, VMProtect packing, sandbox evasion scoring systems, and Polygon blockchain dead-drop resolvers, all designed to evade detection and maximize operational success.

Key Findings:

• 100+ domains identified in the distribution ecosystem
• Multi-stage attack chain involving packers, stagers, in-memory payloads, and decoy executables
• Advanced evasion including 10-point sandbox scoring, API hashing, and time-based checks
• Blockchain C2 resilience via Polygon smart contracts
• Comprehensive data theft targeting browsers, gaming platforms, VPNs, password managers, and cryptocurrency wallets
• Regional targeting exclusions for CIS countries

Threat Actor Overview

Attribution and Naming

REVSTEALER represents a financially motivated threat cluster with no confirmed nation-state affiliation. The malware family is tracked under multiple names across the security industry:

1.2 Operational Timeline

1.3 Threat Level Assessment

Distribution Ecosystem

Primary Distribution Themes

REVSTEALER leverages social engineering at scale, targeting multiple user demographics through carefully crafted lures. The distribution ecosystem is organized around four primary categories:

Gaming-Related Lures

Gaming represents the most prominent infection vector, exploiting users seeking unfair advantages or enhanced experiences:

Digital Products and Utilities

Social and AI Platform Impersonation

Infrastructure Mapping

Main Distribution Domains

Through HTTP resource hash pivoting and IP address correlation, we identified four primary distribution domains:

• elitecheatsx[.]live: Primary distribution hub
• elitemods[.]shop: Primary distribution hub
• satano[.]xyz: Primary distribution hub
• cheatseller[.]com: Primary distribution hub

Shared Resource Hashes

The following resource hashes were observed across multiple distribution domains, providing strong evidence of common ownership or infrastructure:

• Hash 3ef2f9018a7594f0fc3fd2f99fed6ac58ee563fb410a4f45c6dfb203e7ed221e: Image resource observed on all four main distribution domains
• Hash 8de144822802a17673a4f06767c9ae30458ac6a78c86fe418ce797d6184e25fb: Image resource observed on all four main distribution domains
• Hash 2096f5c6f183a469eb7f6b71f476ec6e62bc0a1b43573f5b907c7b2d2921b34ff: Unknown resource observed on elitecheatsx[.]live and elitemods[.]shop

Extended Infrastructure

Beyond the shared resources on the main domains, additional hashes led to larger clusters of potentially related infrastructure:

• Hash 44d72fd03a76d5a1357c1cbe0eb4b94d079e0e6820cc8c6ebcc82737767f7577: Associated with approximately 70 domains, including satano[.]xyz. The resource appears potentially related to a phishing component, though its exact purpose requires further validation.
• Hash f6be9f1e47c2e2bb1a47c7f917bae7b6d73f0d4edd26c6a8d81f1375ce55475e: Associated with approximately 30 domains, including satano[.]xyz. Preliminary analysis suggests a relationship with REMCOSRAT. Further correlation is required to determine whether this activity is connected to the REVSTEALER campaign.

IP Address Correlation

Hosting infrastructure analysis revealed additional domains resolving to the same IP addresses as the main distribution domains:

IP Cluster 1 (elitecheats[.]live):

• yimmodmenu[.]org
• luxurycheats[.]live
• betterdiscordapp[.]live

IP Cluster 2 (elitemods[.]shop):

• luxurycheat[.]live
• yimmenu-gta5[.]com
• dlss5swapper[.]pro
• scoobymenu[.]live

By combining HTTP resource hash pivoting and shared IP address analysis, we expanded our initial dataset with approximately 100 additional domains potentially associated with the broader REVSTEALER distribution ecosystem. While these findings do not establish that all identified domains are directly involved in REVSTEALER distribution, they provide a broader view of the surrounding infrastructure and several additional leads for further investigation.

Attack Chain Analysis

Multi-Stage Execution Flow

REVSTEALER employs a sophisticated multi-stage attack chain designed to evade detection at each phase. The following diagram illustrates the complete flow from initial access through final payload execution:

Stage-by-Stage Breakdown

Stage 0: Initial Access Vectors

• Fake GitHub Repositories: Trojanized Electron applications disguised as AI tools, specifically a fake Claude Opus 5 repository (T1608.001)
• Gaming Cheat Sites: Direct downloads of cheat software from domains like elitecheatsx[.]live and elitemods[.]shop (T1608.001)
• Hijacked YouTube Channels: AI-generated videos linking to malicious download sites in video descriptions (T1566.002)
• Software Crack Sites: Pirated software with bundled malware, including fake versions of Slack, qBittorrent, and SteelSeries GG (T1204.002)

Stage 1: Packer/Stager

Initial Archive SHA256: 251aa2b0831d88a6f796bb6ca01d0242c11476b2fc6a5baa3f9c64a9134cd61d

• Techniques: T1047 (WMI), T1059 (Command and Scripting Interpreter), T1129 (Shared Modules), T1055 (Process Injection), T1027 (Obfuscation), T1497 (Sandbox Evasion), T1562 (Impair Defenses), T1033 (System Owner/User Discovery), T1057 (Process Discovery), T1082 (System Information Discovery), T1071 (Application Layer Protocol)
• Packing: VMProtect
• Behavior: WMI execution, command interpreter spawning, process injection

Stage 1 SHA256: d23b9609b06ab23243543ee0d8ff0d4c1966530576fa37bb2ecde97309ebbc9e

• Techniques: T1047, T1059, T1129, T1198 (SIP and Trust Provider Hijacking), T1055, T1027, T1045 (Software Packing), T1497, T1562, T1033, T1057, T1063 (Security Software Discovery), T1082, T1071
• Notable capability: SIP and Trust Provider Hijacking
• Behavior: Security software discovery and sandbox evasion

Stage 2: In-Memory Payload

Stage 2 SHA256: 724b400afcec2064a3477abd9a117103abfb51f7f7c8acd9c429fcdabd656ffc

• Techniques: T1129 (Shared Modules), T1027 (Obfuscation), T1056 (Input Capture), T1033 (System Owner/User Discovery), T1057 (Process Discovery), T1082 (System Information Discovery), T1083 (File and Directory Discovery), T1071 (Application Layer Protocol)
• Execution: Fileless, in-memory only
• Capabilities: Input capture, system profiling, C2 communication

Decoy Payload

Decoy SHA256: 851383fb22dcb1d16367839178271eef6504199b8ca60405e1698879696e49d4

• Purpose: Distraction and analysis evasion
• Techniques: T1047, T1059, T1129, T1055, T1027, T1497, T1562, T1033, T1057, T1082, T1071

Electron Application Attack Flow

For the fake Claude AI campaign, the attack follows this specific sequence:

The application launches without any user interface, which is atypical for legitimate Electron applications. Before decrypting the embedded payload, it runs a comprehensive host validation routine that includes memory checks, CPU core count analysis, hostname and username inspection, GPU adapter enumeration, system language verification to exclude CIS region victims, and sandbox scoring with a termination threshold of seven out of ten possible points.

If the host passes validation, the malware decrypts its AES-256-CBC embedded payload, writes it to a randomly named directory under AppData, attempts to add that directory to Microsoft Defender's exclusion list, and executes the native payload using indirect syscalls. After credential harvesting and data exfiltration complete, the malware self-deletes to remove forensic artifacts.

MITRE ATT&CK Mapping

Resource Development (TA0042)

• T1608.001 (Stage Capabilities: Upload Malware): Staged a trojanized Electron application in a fake Claude AI GitHub repository to lure victims.
• T1588.006 (Obtain Capabilities: Vulnerabilities): Hijacked established YouTube channels to post AI-generated game cheat videos linking to malicious download sites.

Initial Access (TA0001)

• T1566.002 (Phishing: Spearphishing Link): Distributed malicious links via hijacked YouTube video descriptions pointing to fake cheat and software download domains.

Execution (TA0002)

• T1106 (Native API): Resolved Windows APIs without an import table and called the kernel through 14 indirect syscall wrappers to bypass user-mode monitoring hooks.
• T1106 (Native API): Called Windows Native API functions including OpenClipboard, GetClipboardData, GetEnvironmentStringsW, and CryptUnprotectData directly.
• T1204.002 (User Execution: Malicious File): Executed a roughly 101 MB trojanized Electron executable downloaded from the fake Claude AI GitHub repository.
• T1204.002 (User Execution: Malicious File): Executed malicious payloads disguised as game cheats and legitimate software including Slack, qBittorrent, and SteelSeries GG.
• T1047 (Windows Management Instrumentation): Execution via WMI.
• T1059 (Command and Scripting Interpreter): PowerShell and batch script execution for payload delivery.
• T1129 (Shared Modules): Loading shared modules for payload execution across all stages.
• T1055 (Process Injection): Multiple injection variants executed across stages.
• T1064 (Scripting): Script-based execution observed in the EliteCheatsX archive.

Persistence (TA0003)

• T1053.005 (Scheduled Task/Job: Scheduled Task): Deliberately avoided. REVSTEALER operates as a single burst with no persistence to minimize detection surface.
• T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder): Deliberately avoided. No registry persistence or startup entries by design to minimize forensic footprint.
• T1543 (Create or Modify System Process): Observed in some payload variants.

The two avoided techniques are recorded because the negative space is a core tradecraft signal. A high-impact process tree with no autoruns is itself anomalous and should be hunted.

Privilege Escalation (TA0004)

• T1055 (Process Injection): Injection variants also serve privilege escalation paths.
• T1543 (Create or Modify System Process): System process creation for elevated execution in some variants.

Defense Evasion (TA0005)

The spreadsheet labels this tactic as Stealth and Defense Impairment. Procedures are consolidated here with the original label noted where non-canonical.

• T1027 (Obfuscated Files or Information): Resolved Windows API functions at runtime without an import table to defeat signature-based and behavioral detection.
• T1027.002 (Obfuscated Files or Information: Software Packing): Packed REVSTEALER and all four follow-on modules with VMProtect to resist analysis and signature detection.
• T1027.007 (Obfuscated Files or Information: Dynamic API Resolution): Resolved Windows API functions at runtime using FNV-1a API hashing to avoid static string detection of API names.
• T1027.013 (Obfuscated Files or Information: Encrypted/Encoded File): Stored the native payload as an AES-256-CBC encrypted resource inside the Electron application to evade static analysis.
• T1036.001 (Masquerading: Invalid Code Signature): Impersonated Anthropic's Claude Opus 5 AI product to lure victims into downloading the malicious Electron application.
• T1036.005 (Masquerading: Match Legitimate Name or Location): Wrote the native payload to a randomly named directory under AppData to blend with legitimate application data.
• T1070.004 (Indicator Removal: File Deletion): Deleted its own staging file after launching the native payload and self-deleted after completing theft.
• T1070.004 (Indicator Removal: File Deletion): Executed self-deletion after completing malicious activity to remove forensic evidence.
• T1140 (Deobfuscate/Decode Files or Information): Decrypted the AES-256-CBC embedded resource payload only after all host validation gates passed.
• T1497 (Virtualization/Sandbox Evasion): Validated memory, CPU cores, hostname, username, and GPU adapter before decrypting the payload.
• T1497 (Virtualization/Sandbox Evasion): Implemented a ten-check weighted sandbox scoring system terminating execution when the score reached seven or higher.
• T1497.001 (Virtualization/Sandbox Evasion: System Checks): Scored the host environment across ten weighted anti-VM tests before executing theft.
• T1497.003 (Virtualization/Sandbox Evasion: Time Based Evasion): Wiped the encoded string table if a JavaScript debugger statement paused execution for more than 100 milliseconds.
• T1497.003 (Virtualization/Sandbox Evasion: Time Based Checks): Performed sleep and system uptime timing checks as part of sandbox scoring to detect accelerated analysis environments.
• T1574.001 (Hijack Execution Flow: DLL Side-Loading): Exploited DLL hijacking to load malicious DLLs through the legitimate process search order.
• T1620 (Reflective Code Loading): Employed indirect syscalls, API hashing, and custom exception handling to avoid user-mode hooks and enable fileless execution.
• T1685 (Impair Defenses: Disable or Modify Tools): Attempted to add the user's AppData folder to Microsoft Defender's exclusion list before launching the payload. Labeled Defense Impairment in the source spreadsheet.
• T1562 (Impair Defenses): Security tool manipulation observed across stages.
• T1564 (Hide Artifacts): Artifact concealment techniques observed in the EliteCheatsX payload.
• T1564.003 (Hide Artifacts: Hidden Artifacts): Hidden executable and DLL writes under AppData.
• T1045 (Software Packing): Packer-based obfuscation in the Stage 1 stager.
• T1198 (SIP and Trust Provider Hijacking): Trust provider manipulation observed in the Stage 1 stager.

Credential Access (TA0006)

• T1539 (Steal Web Session Cookie): Stole browser session cookies as part of comprehensive browser data collection targeting authenticated sessions.
• T1539 (Steal Web Session Cookie): Decrypted Roblox session cookies using CryptUnprotectData, enabling full account takeover without the victim's password.
• T1555 (Credentials from Password Stores): Extracted credentials from Windows Credential Manager and a dozen password manager applications.
• T1555 (Credentials from Password Stores): Harvested credentials from 225 Chromium extension password managers, 51 standalone wallet applications, and VPN and 2FA applications.
• T1555.003 (Credentials from Password Stores: Credentials from Web Browsers): Collected browser databases, encryption keys, and extension storage from installed browsers.
• T1555.003 (Credentials from Password Stores: Credentials from Web Browsers): Extracted browser credentials and cookies from Chromium-based browsers including an App-Bound Encryption bypass via hardware breakpoint on the browser process.
• T1056 (Input Capture): Keylogging and input interception.

Discovery (TA0007)

• T1082 (System Information Discovery): Enumerated physical memory size, CPU core count, hostname, username, and GPU adapter to validate the target environment.
• T1082 (System Information Discovery): Collected a comprehensive victim system profile including OS version, CPU, RAM, GPU, hostname, username, timezone, and screen resolution.
• T1614.001 (System Location Discovery: System Language Discovery): Terminated execution on Russian, Ukrainian, and Central Asian language settings to avoid targeting CIS-region victims.
• T1614.001 (System Location Discovery: System Language Discovery): Queried system language and keyboard layout using FNV-1a hashes to exclude CIS-region victims before execution.
• T1012 (Query Registry): Queried the Windows uninstall registry key to enumerate installed applications.
• T1057 (Process Discovery): Collected a full running process listing as part of victim profiling.
• T1083 (File and Directory Discovery): Targeted specific file paths for gaming platforms, configuration files, and user directories to locate credentials and session data.
• T1033 (System Owner/User Discovery): Username enumeration.
• T1063 (Security Software Discovery): AV and EDR detection.
• T1518 (Software Discovery): Installed application enumeration.

Collection (TA0009)

• T1005 (Data from Local System): Collected VPN credentials, messaging application data, game launcher data, OBS profiles, and selected user documents.
• T1113 (Screen Capture): Captured screenshots of the victim's screen as part of a comprehensive data collection routine.
• T1113 (Screen Capture): Captured a full screenshot of the victim machine desktop as part of victim profiling.
• T1115 (Clipboard Data): Collected clipboard contents targeting sensitive copied material such as passwords and wallet addresses.
• T1115 (Clipboard Data): Collected the latest clipboard contents using OpenClipboard and GetClipboardData Windows API calls.
• T1560.001 (Archive Collected Data: Archive via Utility): Packaged collected data into encrypted typed records for streaming exfiltration rather than building a single on-disk archive.
• T1560.001 (Archive Collected Data: Archive via Utility): Packaged stolen credentials and collected data into builds configured for multiple lure themes before exfiltration.
• T1025 (Data from Removable Media): Collected selected documents and configuration files from non-system drives in addition to user profile directories.

Command and Control (TA0011)

• T1568 (Dynamic Resolution): Retrieved a fallback C2 address from a Polygon blockchain smart contract when the primary server was unreachable.
• T1573 (Encrypted Channel): Pulled C2 configuration from encrypted storage only at the moment of use to prevent static analysis of configuration.
• T1573 (Encrypted Channel): Communicated with C2 servers over port 443 and decrypted fallback addresses using embedded AES keys.
• T1102 (Web Service): Queried Polygon blockchain JSON-RPC endpoints as a dead drop resolver to retrieve an encrypted fallback C2 address when the primary server was unavailable.
• T1102.001 (Web Service: Dead Drop Resolver): Used Polygon smart contracts as EtherHiding dead drops storing AES-encrypted fallback C2 endpoints for infrastructure resilience.
• T1071 (Application Layer Protocol): HTTP and HTTPS C2 communication.

Exfiltration (TA0010)

• T1041 (Exfiltration Over C2 Channel): Exfiltrated stolen data as encrypted typed records streamed to the C2 server, avoiding a single on-disk archive.
• T1567 (Exfiltration Over Web Service): Streamed encrypted collected data to C2 infrastructure with blockchain-based failover for resilient exfiltration.
• T1567 (Exfiltration Over Web Service): Exfiltrated harvested credentials, cookies, screenshots, and clipboard data to attacker-controlled C2 servers over HTTPS.

Impact (TA0040)

• T1486 (Data Encrypted for Impact): Referenced operator-delivered ransomware payloads delivered via the tasking channel as a downstream impact capability.
• T1486 (Data Encrypted for Impact): Deployed the LockAppHost module with XMRig and persistence capabilities, providing encrypted blockchain-based configuration for command execution.
• T1496 (Resource Hijacking): Deployed an XMRig cryptominer via the LockAppHost module to hijack victim CPU resources for Monero mining.

Technical Deep Dive

Anti-Analysis Techniques

Sandbox Evasion Scoring System

REVSTEALER implements a sophisticated 10-point weighted scoring system to detect analysis environments. The following diagram illustrates the decision flow:

The scoring system evaluates the following host characteristics:

• Memory Size: Systems with less than 4 GB RAM are flagged as potential sandboxes
• CPU Cores: Systems with fewer than 2 cores are flagged
• Hostname Patterns: Known sandbox naming conventions trigger detection
• Username Patterns: Usernames containing "sandbox", "malware", or "test" are flagged
• GPU Adapter: Virtual GPU detection carries double weight
• System Uptime: Low uptime indicates a freshly provisioned virtual machine
• Sleep Timing: Accelerated time detection identifies time-accelerated sandboxes
• Debugger Presence: JavaScript debugger detection with 100ms pause threshold
• Process List: Analysis tool detection in running processes
• Registry Artifacts: VM-specific registry keys

Execution terminates if the cumulative score reaches 7 or higher.

Time-Based Evasion

REVSTEALER monitors for debugger pauses during execution. If a JavaScript debugger statement causes execution to pause for more than 100 milliseconds, the malware wipes its encoded string table and terminates, preventing analysis.

API Hashing (FNV-1a)

REVSTEALER uses FNV-1a hashing to resolve Windows API functions at runtime, avoiding static string detection. The following APIs are resolved through this mechanism:

• OpenClipboard
• GetClipboardData
• GetEnvironmentStringsW
• CryptUnprotectData
• NtQuerySystemInformation
• More than 50 additional APIs

Indirect Syscalls

The malware implements 14 indirect syscall wrappers to bypass user-mode hooks. Unlike direct syscalls that use the syscall instruction directly, indirect syscalls jump to a gadget within ntdll.dll that performs the syscall and returns, bypassing EDR hooks placed on ntdll functions.

Credential Harvesting Capabilities

Browser Data Theft

REVSTEALER targets all major Chromium-based and Firefox-based browsers:

• Google Chrome: Passwords, cookies, history, with App-Bound Encryption bypass
• Microsoft Edge: Passwords, cookies, history, with App-Bound Encryption bypass
• Brave: Passwords, cookies, history, with App-Bound Encryption bypass
• Mozilla Firefox: Passwords, cookies, history through profile database extraction
• Opera: Passwords, cookies, history through profile database extraction
• Vivaldi: Passwords, cookies, history through profile database extraction

The App-Bound Encryption bypass uses hardware breakpoints on browser processes to extract encrypted data that would normally be protected by Chrome's App-Bound Encryption feature.

Password Manager Targeting

REVSTEALER targets an extensive list of password managers:

• 225 Chromium Extensions: Including Bitwarden, LastPass, and 1Password
• 51 Standalone Applications: Including KeePass and Dashlane
• 2 System Credential Stores: Windows Credential Manager and DPAPI-protected stores

Cryptocurrency Wallet Targeting

• Browser Extensions: MetaMask, Phantom, Coinbase Wallet
• Desktop Applications: Exodus, Electrum, Atomic Wallet
• Hardware Wallet Software: Ledger Live, Trezor Suite

Gaming Platform Targeting

• Steam: loginusers.vdf and local.vdf files for account takeover
• Roblox: RobloxCookies.dat and appStorage.json for session hijacking via CryptUnprotectData decryption
• Battle.net: Battle.net.config for account access
• EA Desktop: INI configuration files for account access
• BSG Launcher: Settings files for Escape from Tarkov account access
• Minecraft: Nine different launcher configuration files including launcher_accounts.json, TlauncherProfiles.json, and others for account access

The following diagram shows the complete credential harvesting scope:

Command and Control Infrastructure

Primary C2 Communication

• Protocol: HTTPS on port 443
• Data Format: Encrypted typed records
• Streaming: Continuous exfiltration without building an on-disk archive
• Encryption: Per-build AES keys

Blockchain Dead Drop Resolver

REVSTEALER implements a resilient C2 fallback mechanism using Polygon blockchain. The following diagram illustrates this failover process:

When the primary C2 server is unreachable, REVSTEALER queries Polygon JSON-RPC endpoints to read smart contract data. The C2 address is stored in the smart contract's data field using a technique called EtherHiding, which makes takedown extremely difficult because blockchain data is immutable. The retrieved data is AES-encrypted and requires the embedded key to decrypt.

EtherHiding Technique

C2 addresses are stored in smart contract data fields on the Polygon blockchain. This approach provides several advantages for the attacker:

• Resilience: Blockchain data cannot be taken down or modified
• Anonymity: Smart contract deployment can be done from any wallet
• Persistence: The data remains accessible as long as the blockchain exists
• Deniability: Reading blockchain data is indistinguishable from legitimate Web3 activity

Payload Modules

LockAppHost Module

The LockAppHost module provides additional capabilities beyond the core REVSTEALER payload:

• XMRig Integration: Monero cryptocurrency miner for resource hijacking
• Persistence: Module-specific persistence mechanism
• Configuration: Blockchain-based encrypted configuration
• Command Execution: Remote command capability

Ransomware Capability

REVSTEALER's tasking channel supports operator-delivered ransomware payloads, indicating potential for:

• Double extortion operations
• Data encryption for impact
• Ransom demand delivery

Indicators of Compromise (IOCs)

Network IOCs

Main Distribution Domains

• elitecheatsx[.]live
• elitemods[.]shop
• satano[.]xyz
• cheatseller[.]com
• yimmodmenu[.]org
• luxurycheats[.]live
• betterdiscordapp[.]live
• luxurycheat[.]live
• yimmenu-gta5[.]com
• dlss5swapper[.]pro
• scoobymenu[.]live

Additional Distribution Domains

• m.trjobobet1[.]cfd
• trumpware[.]org
• rblxshop[.]net
• cheapmarket[.]net
• r4geshop[.]com
• eclipsefortnite[.]com
• donutheist[.]com
• Irw[.]plus
• privatemarket[.]cc
• aricado[.]shop
• kryptstore[.]com
• bulkr[.]cc
• lemon[.]tf
• dma-cheats[.]com
• dma-hardware[.]com
• dizzydma[.]com
• hame[.]agency
• shinobimarket[.]store
• taobaohook[.]cc
• rblxscripts[.]net
• corefivem[.]mysellauth[.]com
• 069reselling[.]cc
• nicks[.]lol
• travocheats[.]com
• nfaccount[.]com
• pureboosts[.]rip
• adwin[.]cc
• galaxy2k[.]com

REMCOSRAT-Associated Domains

• vacmodz[.]com
• glpr0daja[.]mysellauth[.]com
• magicstore[.]club
• ogstockers[.]mysellauth[.]com
• dsdailystore[.]mysellauth[.]com
• revoxstore[.]mysellauth[.]com
• stromstock[.]mysellauth[.]com
• mmediaservices[.]mysellauth[.]com
• ycalstore[.]mysellauth[.]com
• synora[.]gg
• eliteboostz[.]mysellauth[.]com
• vantageservices[.]mysellauth[.]com
• ecart[.]mysellauth[.]com
• auto-boosts[.]mysellauth[.]com
• cokixstocks[.]mysellauth[.]com
• monkeymartservices[.]com
• monkeymart[.]mysellauth[.]com
• jewkeys[.]shop
• chrasherout[.]mysellauth[.]com
• spotify-market[.]mysellauth[.]com
• nextgen-market[.]pl

Blockchain RPC Domains

• polygon-rpc[.]com
• rpc-mainnet[.]matic[.]network
• rpc[.]ankr[.]com
• polygon-mainnet[.]infura[.]io
• matic-mainnet[.]chainstacklabs[.]com
• polygon-mainnet[.]g[.]alchemy[.]com

File Hashes

Sample Hashes

• 23189bc66fc17afca7d0f8f81def27dc (MD5): YimMenuV2_Enhanced.rar
• 23337b495bcb5c3635d9c89adb4e40ee (MD5): CheraxMenu.rar
• 3c609886f8b49ebfd7c7c279abc74cb4 (MD5): YimMenuV1_Legacy.rar
• b2e255a8054625c702abf025752dd37d (MD5): Cherax product page
• c083a98b7041991528225a4b85bfae67 (MD5): EliteCheatsX-2.0.zip
• 251aa2b0831d88a6f796bb6ca01d0242c11476b2fc6a5baa3f9c64a9134cd61d (SHA256): Initial ZIP archive
• d23b9609b06ab23243543ee0d8ff0d4c1966530576fa37bb2ecde97309ebbc9e (SHA256): Stage 1 packer/stager
• 724b400afcec2064a3477abd9a117103abfb51f7f7c8acd9c429fcdabd656ffc (SHA256): Stage 2 in-memory payload
• 851383fb22dcb1d16367839178271eef6504199b8ca60405e1698879696e49d4 (SHA256): Decoy payload

Resource Hashes

• 3ef2f9018a7594f0fc3fd2f99fed6ac58ee563fb410a4f45c6dfb203e7ed221e: Observed on all four main domains
• 8de144822802a17673a4f06767c9ae30458ac6a78c86fe418ce797d6184e25fb: Observed on all four main domains
• 2096f5c6f183a469eb7f6b71f476ec6e62bc0a1b43573f5b907c7b2d2921b34ff: Observed on elitecheatsx and elitemods
• 44d72fd03a76d5a1357c1cbe0eb4b94d079e0e6820cc8c6ebcc82737767f7577: Associated with approximately 70 domains
• f6be9f1e47c2e2bb1a47c7f917bae7b6d73f0d4edd26c6a8d81f1375ce55475e: Associated with approximately 30 domains

File Path IOCs

Targeted Configuration Files

• \Battle.net\Battle.net.config
• \Battlestate Games\BsgLauncher\settings
• \Electronic Arts\EA Desktop*.ini
• \Steam\local.vdf
• \Steam\loginusers.vdf
• \Roblox\LocalStorage\RobloxCookies.dat
• \Roblox\LocalStorage\appStorage.json
• \intentlauncher\launcherconfig
• .lunarclient\settings\game\accounts.json
• .minecraft\TlauncherProfiles.json
• .feather\accounts.json
• .minecraft\meteor-client\accounts.nbt
• .minecraft\Impact\alts.json
• \Badlion Client\accounts.json
• .minecraft\launcher_accounts.json
• .minecraft\launcher_profiles_microsoft_store.json

Payload Staging Locations

• \AppData\Local\Temp\
• \Windows\Temp\
• \Downloads\
• \Users\Public\

Detection Rules

The following Sigma rules can be used to detect REVSTEALER activity across PowerShell script blocks, process creation, registry modifications, file events, and network connections.

PowerShell Detection Rules

Rule 1: CIM Hardware Inventory Enumeration

title: REVSTEALER Related PowerShell CIM Hardware Inventory
id: ce04052c-bb25-4f31-bfea-7a45bbdb2fed
status: stable
description: Detects the supplied PowerShell hardware inventory pattern combining GPU enumeration with thermal zone, fan, memory, cache, and port queries and JSON serialization. Hardware checks can support sandbox assessment. This pattern is not independently confirmed as exclusive to REVSTEALER and does not establish malware attribution.
references:
    - https://www.elastic.co/security-labs/threat-command/revstealer-credential-harvesting-infostealer
author: AkatsukiLegion
date: 2026-11-03
tags:
    - attack.discovery
    - attack.t1082
logsource:
    product: windows
    category: ps_script
    definition: PowerShell Script Block Logging must be enabled.
detection:
    selection:
        ScriptBlockText|contains|all:
            - 'Get-CimInstance'
            - 'Win32_VideoController'
            - 'MSAcpi_ThermalZoneTemperature'
            - 'Win32_Fan'
            - 'Win32_PhysicalMemory'
            - 'Win32_CacheMemory'
            - 'Win32_PortConnector'
            - 'ConvertTo-Json'
    condition: selection
falsepositives:
    - Hardware inventory, diagnostic, and application compatibility scripts
level: medium

title: REVSTEALER PowerShell Command to Set Defender Exclusions Referencing AppData
id: bb8010ad-a4fe-48a9-99be-e914b9212d85
status: stable
description: Detects PowerShell command lines containing Add-MpPreference or Set-MpPreference with ExclusionPath and an AppData reference. This may indicate an attempt to exclude a payload directory from Microsoft Defender scanning. Process creation events alone do not confirm that the exclusion was successfully applied.
references:
    - https://www.morphisec.com/blog/revstealer-silence-is-its-greatest-weapon/
author: AkatsukiLegion
date: 2026-11-03
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\powershell.exe'
        - Image|endswith: '\pwsh.exe'
        - OriginalFileName:
            - 'PowerShell.EXE'
            - 'pwsh.dll'
    selection_cmdlet:
        CommandLine|contains:
            - 'Add-MpPreference'
            - 'Set-MpPreference'
    selection_exclusion:
        CommandLine|contains: 'ExclusionPath'
    selection_appdata:
        CommandLine|contains: 'AppData'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

title: REVSTEALER PowerShell Script Block to Set Defender Exclusions Referencing AppData
id: c820fede-4662-4e5c-b15e-316939cb40f0
status: stable
description: Detects PowerShell script blocks containing Add-MpPreference or Set-MpPreference with ExclusionPath and an AppData reference. This may indicate an attempt to exclude a payload directory from Microsoft Defender scanning. Script block events alone do not confirm that the exclusion was successfully applied.
references:
    - https://www.morphisec.com/blog/revstealer-silence-is-its-greatest-weapon/
author: AkatsukiLegion
date: 2026-11-03
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: ps_script
    product: windows
detection:
    selection_cmdlet:
        ScriptBlockText|contains:
            - 'Add-MpPreference'
            - 'Set-MpPreference'
    selection_exclusion:
        ScriptBlockText|contains: 'ExclusionPath'
    selection_appdata:
        ScriptBlockText|contains: 'AppData'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

title: RevStealer Chromium-Style Child Process Launched from a User-Writable Parent Location
id: 3ef9f157-22cf-4aba-bb20-9788316f8210
status: stable
description: Detects the execution of an Electron application from user download or temporary directories that spawns characteristic Electron child processes (GPU helper or renderer processes). The RevStealer campaign distributes a trojanized Electron application disguised with Claude AI branding via a fake GitHub repository. The enclosed 64-bit executable runs without any user interface, which is atypical for legitimate Electron applications. This rule identifies Electron process trees originating from non-standard installation directories, which may indicate execution of a malicious Electron-based loader.
references:
    - https://www.morphisec.com/blog/revstealer-silence-is-its-greatest-weapon/
author: AkatsukiLegion
date: 2026-11-03
tags:
    - attack.execution
    - attack.t1204.002
    - attack.stealth
    - attack.t1036.005
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains:
            - '\Downloads\'
            - '\Desktop\'
            - '\AppData\Local\Temp\'
    selection_cmdline:
        CommandLine|contains:
            - '--type=gpu-process'
            - '--type=renderer'
            - '--type=utility'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

title: REVSTEALER Defender Exclusion Registry Event with an AppData Data Reference
id: 3ffad291-fdb8-4c5b-ae59-adca34ec1eda
status: stable
description: Detects registry events under Microsoft Defender's Exclusions\Paths key where the Details field contains AppData. This may indicate exclusion-related activity referencing a payload directory.
references:
    - https://www.morphisec.com/blog/revstealer-silence-is-its-greatest-weapon/
author: AkatsukiLegion
date: 2026-11-03
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: registry_event
    product: windows
detection:
    selection_details:
        TargetObject|contains: '\Microsoft\Windows Defender\Exclusions\Paths'
    selection_appdata:
        Details|contains: 'AppData'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

title: REVSTEALER Minecraft Account Configuration File Creation by a Non-Launcher Process
id: b3802e93-6e5b-4662-8ead-c6b53bb578d5
status: stable
description: Detects creation or overwrite events targeting selected Minecraft client account or configuration paths by processes other than the listed launchers and Java executables. This may indicate account data tampering. A match can involve a single file and does not establish file reads or credential theft.
references:
    - https://www.elastic.co/security-labs/revstealer
author: AkatsukiLegion
date: 2026-11-03
tags:
    - attack.collection
    - attack.t1005
    - attack.discovery
    - attack.t1083
logsource:
    category: file_event
    product: windows
detection:
    selection_files:
        TargetFilename|contains:
            - '\intentlauncher\launcherconfig'
            - '\.lunarclient\settings\game\accounts.json'
            - '\.minecraft\TlauncherProfiles.json'
            - '\.feather\accounts.json'
            - '\.minecraft\meteor-client\accounts.nbt'
            - '\.minecraft\Impact\alts.json'
            - '\Badlion Client\accounts.json'
            - '\.minecraft\launcher_accounts.json'
            - '\.minecraft\launcher_profiles_microsoft_store.json'
    filter_main_launchers:
        Image|endswith:
            - '\javaw.exe'
            - '\java.exe'
            - '\MinecraftLauncher.exe'
            - '\Lunar Client.exe'
            - '\TLauncher.exe'
            - '\Badlion Client.exe'
    condition: selection_files and not filter_main_launchers
falsepositives:
    - Unknown
level: medium

Malware Behavior Catalog Mapping

Behavior Categories

• OB0001 (Anti-Behavioral Analysis): Sandbox evasion and debugger detection
• OB0002 (Anti-Static Analysis): VMProtect, API hashing, and encryption
• OB0003 (Collection): Credential harvesting and file collection
• OB0005 (Credential Access): Browser passwords and wallet keys
• OB0006 (Defense Evasion): Defender exclusion and self-deletion
• OB0007 (Discovery): System profiling and process enumeration
• OB0012 (Persistence): Minimal by design
• OB0013 (Privilege Escalation): Process injection
• OC0001 (File System): File creation and deletion
• OC0004 (Data): Data serialization and encryption
• OC0005 (Cryptography): AES-256 and FNV-1a
• OC0006 (Communication): HTTP/HTTPS and JSON-RPC

Regional Targeting Analysis

CIS Exclusion

REVSTEALER explicitly avoids targeting victims in Commonwealth of Independent States (CIS) countries. The following language and regional settings trigger termination:

• Russian language settings
• Ukrainian language settings
• Central Asian language settings

The detection method uses system language and keyboard layout queries with FNV-1a hashes to identify and exclude CIS-region victims before execution.

This behavior suggests Russian-speaking operators, which is common among financially motivated cybercriminals from the CIS region. The exclusion is designed to avoid local law enforcement attention.

Defensive Recommendations

Strategic Recommendations

• Critical Priority: Block known IOCs at perimeter for immediate reduction in exposure
• Critical Priority: Deploy detection rules to catch active infections
• High Priority: Implement user awareness training to prevent initial execution
• High Priority: Deploy application allowlisting to block unauthorized executables
• Medium Priority: Implement network segmentation to limit lateral movement
• Medium Priority: Tune EDR to improve detection of indirect syscalls

Tactical Recommendations

Endpoint Detection

• Enable PowerShell Script Block Logging
• Monitor for CIM and WMI hardware enumeration
• Alert on Defender exclusion modifications
• Track browser process ancestry
• Monitor AppData executable creation

Network Detection

• Block Polygon RPC domains for non-browser processes
• Monitor for HTTPS C2 beaconing patterns
• Alert on DNS queries to known distribution domains
• Implement SSL inspection where feasible

User Education

• Warn about free game cheats and their risks
• Educate on fake AI tool repositories
• Highlight the risks of pirated software
• Promote official software sources

Hunting Queries

Query 1: Suspicious Browser Spawning

DeviceProcessEvents
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "brave.exe")
| where FolderPath contains_any ("\\Temp\\", "\\Downloads\\", "\\Users\\Public\\")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName

Query 2: Defender Exclusion Modification

DeviceRegistryEvents
| where RegistryKey contains "Windows Defender\\Exclusions\\Paths"
| where RegistryValueData contains "AppData"
| project Timestamp, DeviceName, InitiatingProcessFileName, RegistryValueData

Conclusion

REVSTEALER represents a significant evolution in the infostealer threat landscape. Its combination of industrial-scale distribution, advanced evasion techniques, and resilient command-and-control infrastructure demonstrates a mature, well-resourced threat actor. The malware's focus on gaming communities and users seeking free software exploits human psychology at scale, while its technical sophistication including VMProtect packing, indirect syscalls, API hashing, and blockchain dead drops presents substantial challenges for traditional security controls.

The absence of persistence is a deliberate design choice that trades long-term access for reduced forensic footprint, suggesting operators prioritize volume over depth. However, the comprehensive credential harvesting capabilities and potential for ransomware delivery indicate significant financial motivation and potential for substantial organizational impact.

Defenders must prioritize detection of the behavioral patterns outlined in this report, implement the provided detection rules, and educate users about the risks of downloading software from untrusted sources. The blockchain-based C2 fallback mechanism represents a particularly concerning trend that may proliferate among other malware families.