RevStealer Windows Infostealer (Elastic REF2859) Uses 14 Indirect Syscalls and EtherHiding C2 to Steal Browser and Wallet Credentials

Key facts

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5613 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: RevStealer (REF2859) Lure Executable or Known Sample Hash Executed From User-Writable Path — Exploitation

Detects execution of known RevStealer/REF2859 sample hashes (main stealer, resightloader.exe, SteelSeriesGG.exe, slack.exe, qBittorrent.exe lure builds from Elastic) or of the lure file names run from Downloads, Desktop, AppData\Local\Temp or AppData\Roaming instead of a normal install location. RevStealer is distributed through game-cheat lures and trojanized Electron builds masquerading as Slack, qBittorrent and SteelSeries GG, so the user-writable path plus lure name is the durable behavioural signal when hashes rotate. Maps to T1204.002 and T1027 (VMProtect-packed builds).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1027
• Data sources: sysmon, DeviceProcessEvents, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 | eval hash_hit=if(match(Hashes,"(?i)(adc4aa652965396b52e79435ca54987ae9eb21bf5e67de5e9461b09655165ee4|4c897108e8e793d6904110928c996815c302d6975c9bc61162149e855a963d50|8b33e0f32c42a317e3d9cd67d5a6dc68e91a6cf9dd44742162858e7d83cf2073|bd97d5cab2d09b001d1b9e08890bce1a2b2cf8542a4b31c86b2def59328cafb2|1617552169df805405b1bb70f742d6eac5af342f31c6e39ff6b9613bd2392354)"),1,0) | eval lure_name=if(match(Image,"(?i).(slack|qbittorrent|steelseriesgg|resightloader)[.]exe$"),1,0) | eval user_path=if(match(Image,"(?i)Users.+(Downloads|Desktop|AppData.Local.Temp|AppData.Roaming)"),1,0) | eval legit_install=if(match(Image,"(?i)(Program Files|AppData.Local.slack|WindowsApps)"),1,0) | where hash_hit=1 OR (lure_name=1 AND user_path=1 AND legit_install=0) | stats count min(_time) as first_seen max(_time) as last_seen values(ParentImage) as parent_image values(CommandLine) as command_line by host, User, Image, Hashes | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let ioc_sha256 = dynamic(["adc4aa652965396b52e79435ca54987ae9eb21bf5e67de5e9461b09655165ee4","4c897108e8e793d6904110928c996815c302d6975c9bc61162149e855a963d50","8b33e0f32c42a317e3d9cd67d5a6dc68e91a6cf9dd44742162858e7d83cf2073","bd97d5cab2d09b001d1b9e08890bce1a2b2cf8542a4b31c86b2def59328cafb2","1617552169df805405b1bb70f742d6eac5af342f31c6e39ff6b9613bd2392354"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where SHA256 in~ (ioc_sha256)
    or (FileName in~ ("slack.exe", "qbittorrent.exe", "steelseriesgg.exe", "resightloader.exe")
        and FolderPath has_any ("Downloads", "Desktop", "AppData")
        and not(FolderPath contains "Program Files")
        and not(FolderPath contains "Local\\slack"))
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: RevStealer Lure Executable or Known REF2859 Hash Executed From User-Writable Path
id: 7c1f3a52-8d4e-4b6a-9e21-5a0c3d7f1b84
status: experimental
description: Detects known RevStealer/REF2859 sample hashes, or Slack, qBittorrent, SteelSeries GG and resightloader executables running from Downloads, Desktop or AppData instead of a legitimate install path.
references:
  - https://www.elastic.co/security-labs/threat-command/revstealer-credential-harvesting-infostealer
  - https://github.com/elastic/labs-releases/tree/main/indicators/revstealer
author: Threadlinqs Team
date: 2026/11/10
tags:
  - attack.execution
  - attack.t1204.002
  - attack.defense-evasion
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_hash:
    Hashes|contains:
      - 'adc4aa652965396b52e79435ca54987ae9eb21bf5e67de5e9461b09655165ee4'
      - '4c897108e8e793d6904110928c996815c302d6975c9bc61162149e855a963d50'
      - '8b33e0f32c42a317e3d9cd67d5a6dc68e91a6cf9dd44742162858e7d83cf2073'
      - 'bd97d5cab2d09b001d1b9e08890bce1a2b2cf8542a4b31c86b2def59328cafb2'
      - '1617552169df805405b1bb70f742d6eac5af342f31c6e39ff6b9613bd2392354'
  selection_name:
    Image|endswith:
      - '\slack.exe'
      - '\qbittorrent.exe'
      - '\steelseriesgg.exe'
      - '\resightloader.exe'
  selection_path:
    Image|contains:
      - '\Downloads\'
      - '\Desktop\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
  filter_legit:
    Image|contains:
      - '\Program Files'
      - '\AppData\Local\slack\'
  condition: selection_hash or (selection_name and selection_path and not filter_legit)
fields:
  - Image
  - CommandLine
  - ParentImage
  - Hashes
falsepositives:
  - Legitimate portable Slack, qBittorrent or SteelSeries builds run from Downloads
level: high

Known false positives:

• Legitimate portable builds of Slack, qBittorrent or SteelSeries GG run from the Downloads folder
• Users who download official installers and run them before installation completes

Tuning notes: Allowlist the paths and signers of your sanctioned Slack, qBittorrent and SteelSeries deployments. Add new sample hashes from Elastic's indicator repository as they are published. Require the process to be unsigned if your telemetry includes signature status.

• 🔒 RevStealer Cheat-Site and Lure-Archive Distribution Contact — Exploitation · unlock with TL Creds
• 🔒 RevStealer Browser, Roblox Cookie and Credential Store Theft Including ABE Bypass Browser Launch — Post-Exploitation · unlock with TL Creds
• 🔒 RevStealer Primary and Module C2 Domain Connections From Endpoint — C2 · unlock with TL Creds
• 🔒 Fake 'Claude Opus 5 Free Desktop' Trojanized Electron App Execution — Exploitation · unlock with TL Creds
• 🔒 RevStealer-Linked LockAppHost Miner Deployment: CMSTP Elevation, Windows Update Disablement, Hidden Miner Process — Post-Exploitation · unlock with TL Creds
• 🔒 RevStealer Known and Pattern-Matched polygon.* C2 Hostname DNS Resolution — C2 · unlock with TL Creds
• 🔒 RevStealer Microsoft Defender Exclusion for AppData Path With Hidden Launch — Post-Exploitation · unlock with TL Creds
• 🔒 RevStealer EtherHiding Polygon RPC Dead-Drop Lookups From Non-Browser User-Path Process — C2 · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 31 indicators of compromise for TL-2026-5613.

Sample indicators (3 of 31)

• Domain: elitecheatsx[.]live
• File hash: adc4aa652965396b52e79435ca54987ae9eb21bf5e67de5e9461b09655165ee4
• Domain: resight-cheats[.]net

Defanged, TLP:CLEAR. Full set of 31 indicators: unlock with TL Creds.

Technical analysis

RevStealer (stylised REVSTEALER) is a Windows infostealer first documented by Gen Threat Labs in July 2026 and analysed in depth by Elastic Security Labs on 2026-09-02, which tracks the activity as REF2859. Elastic's retrohunt matched about 4,733 unique files on VirusTotal between 2026-02-16 and 2026-08-27; this counts files, not confirmed victims. The stealer is reported to be sold commercially. No operator or group has been publicly identified; REF2859 is a tracking label, not an actor name. The CIS-locale exit check suggests, but does not prove, Russian-speaking operators.

Distribution relies on social engineering. Elastic found at least 17 YouTube channels (many hijacked, one with 24.4K subscribers) posting short AI-generated cheat/mod-menu demos that link to cheat-download sites such as elitecheatsx.live and resight-cheats.net. Akatsuki Legion (2026-11-09) reports more than 100 related domains selling cheats, boosters, HWID spoofers, fake AI tools and pirated software, though not every domain is confirmed as RevStealer distribution. Morphisec (2026-08-31) documented a fake 'Claude Opus 5 Free Desktop' GitHub project that copied Anthropic's branding and shipped a roughly 101 MB trojanized 64-bit Electron app; there is no indication Anthropic was compromised. Other samples masquerade as Slack, qBittorrent, SteelSeries GG and Blender, and are often VMProtect-packed.

The Electron loader runs with no UI, requires at least 2 GiB RAM and two logical CPUs, checks hostname, username and GPU, and wipes its encoded string table if a JavaScript debugger pause exceeds about 100 ms. It decrypts an AES-256-CBC resource, writes the native payload to a randomly named AppData folder, attempts to add that folder to Microsoft Defender exclusions, and launches it hidden. The native stage resolves APIs without an import table (FNV-1a hashing), uses 14 indirect syscall wrappers (it sorts ntdll Zw* exports by address, uses the index as the syscall number and jumps to a random syscall;ret gadget in ntdll), applies a weighted ten-check sandbox score (terminate at 7 or higher), exits on CIS language/keyboard settings, and in unpacked builds shows a six-character CAPTCHA-style gate. A vectored exception handler keeps remaining collectors running if one fails.

Theft covers Chromium and Firefox browser data, 225 Chromium extension IDs, 51 standalone wallet applications, password managers, VPN/FTP clients, messaging apps, 2FA tools, OBS profiles, Windows Credential Manager, clipboard, screenshots and gaming accounts (Steam, Battle.net, EA Desktop, Roblox, Minecraft launchers, Battlestate Games). Chrome App-Bound Encryption is bypassed by launching the browser under a debugger, setting a hardware breakpoint near the decryption code and reading the key from memory; Elastic assesses this was likely adapted from the public ChromeKatz/ElevationKatz project. The Roblox session cookie is decrypted to allow takeover without a password. Data is streamed as encrypted typed records over HTTPS/443. If the primary C2 is unreachable, the build queries up to five public Polygon JSON-RPC endpoints for its embedded smart-contract address and decrypts a fallback C2 with an embedded AES key (EtherHiding). The stealer reports completion, self-deletes and has no persistence, and can download and run additional executables.

Elastic also recovered four companion executables that share the stealer's packer, runtime function resolution and Polygon config approach: ProManager (wallet file/extension theft, overlays, input capture), WinUpdate (clipboard crypto-address replacement and mnemonic-shaped text collection), SoftManager (reverse SOCKS5 proxy over encrypted WebSocket) and LockAppHost (XMRig deployment with CMSTP elevation, Defender exclusions, disabling of 5 Windows Update services and 11 update plus 2 malware-removal scheduled tasks, miner hidden in suspended nslookup.exe or svchost.exe). Elastic did not observe any of the four delivered to a live RevStealer host; the link rests on shared code and investigative context. Note that GBHackers' mapping of module names to functions is inconsistent with Elastic and The Hacker News; this record follows the latter. The public Elastic YARA file does not cover LockAppHost.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1070.004 File Deletion; T1218.003 CMSTP; T1497.003 Time Based Checks; T1564.003 Hidden Window; T1622 Debugger Evasion

Command and Control

T1071.001 Web Protocols; T1090 Proxy; T1102.001 Dead Drop Resolver

Discovery

T1082 System Information Discovery

Execution

T1106 Native API; T1204.002 Malicious File

Collection

T1113 Screen Capture

Impact

T1496.001 Compute Hijacking

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers; T1555.004 Windows Credential Manager

Initial Access

T1566.002 Spearphishing Link

defense-impairment

T1685 Disable or Modify Tools

Remediation

Immediate actions

• Block the listed distribution, C2 and module C2 domains at DNS and web proxy
• Isolate hosts that ran a suspect cheat, fake AI tool or unsigned Electron build; rotate all passwords and revoke active sessions (cookies and the App-Bound Encryption key are stolen, so a password reset alone is insufficient)
• Move cryptocurrency from wallets exposed on the host to a new wallet created on a clean device
• On hosts with LockAppHost, remove added Defender exclusions, re-enable Windows Update services and tasks, and inspect suspended nslookup.exe/svchost.exe for a hidden miner

Workarounds

• Install AI desktop tools only from vendors' official channels; avoid game cheats and cracked software

Longer-term hardening

• Alert on new Microsoft Defender exclusions pointing to AppData paths
• Alert on Polygon JSON-RPC queries (polygon-rpc.com, rpc.ankr.com, Infura, Alchemy, Chainstack) from user-writable paths
• Restrict execution of unsigned Electron applications and software downloaded from GitHub or cheat/crack sites
• Deploy EDR rules for hardware-breakpoint abuse and browsers launched under a debugger or from an unusual parent
• Deploy Elastic YARA Windows.Trojan.RevStealer and the Wazuh rule 117317

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows endpoints running unsigned cheat, fake AI or trojanized Electron executables
• Google — Chrome / Chromium browsers (App-Bound Encryption bypassed by debugger and hardware breakpoint)
  Vulnerable versions: Chromium-based browsers using App-Bound Encryption

Timeline

• 2026-02-16 Earliest RevStealer-matching sample submitted to VirusTotal (start of Elastic's 4,733-file retrohunt window)
• 2026-07-01 Gen Threat Labs first documents RevStealer (reported as 'July 2026'; exact day not stated, 1st used as placeholder)
• 2026-08-27 End of Elastic's VirusTotal retrohunt window; about 4,733 matching files submitted since 2026-02-16
• 2026-08-31 Morphisec reports a fake 'Claude Opus 5 Free Desktop' GitHub project delivering RevStealer via a ~101 MB trojanized Electron app
• 2026-09-01 GBHackers publishes coverage of the fake Claude Opus 5 app delivering RevStealer
• 2026-09-02 Elastic Security Labs publishes REF2859 analysis: 17+ YouTube channels, Polygon EtherHiding fallback C2, ABE bypass, YARA rule and indicators
• 2026-09-06 The Hacker News reports four linked modules (ProManager, WinUpdate, SoftManager, LockAppHost) including a Defender- and Windows Update-disabling miner deployer
• 2026-11-09 Akatsuki Legion publishes research on the 100+ domain RevStealer distribution ecosystem
• 2026-11-10 GBHackers publishes coverage of RevStealer's 14 indirect syscall wrappers and credential theft

Sources cited

• REVSTEALER ramps up: analysis of up-and-coming infostealer (Elastic Security Labs) elastic.co · Research · 2026-09-02
• Inside RevStealer's growing distribution ecosystem (Akatsuki Legion) akatsukilegion.com · Research · 2026-11-09
• Morphisec RevStealer Threat Analysis (fake Claude Opus 5 desktop app) engage.morphisec.com · Vendor report · 2026-08-31
• Elastic Labs releases: RevStealer indicators GitHub · Code repository · 2026-09-02
• ChromeKatz (public App-Bound Encryption bypass tooling) GitHub · Proof of concept
• Four REVSTEALER-linked modules disable Windows Update and Defender (The Hacker News) The Hacker News · News · 2026-09-06
• Fake Claude Opus 5 App Delivers RevStealer (GBHackers) gbhackers.com · News · 2026-09-01
• RevStealer Bypasses Security Monitoring With 14 Indirect Syscalls to Steal Browser and Wallet Credentials (GBHackers) gbhackers.com · News · 2026-11-10

More in malware

• Blind Eagle (APT-C-36) Uses Fake Court Notices to Deliver AsyncRAT/DCRat-Lineage RAT Across Latin America
• GhostFrame: New ESXi Post-Exploitation Implant Linked to TAG-218 / Settra Ransomware
• Formbook (XLoader) Campaign Targets European Manufacturing and Technology Businesses with Localized Order Lures
• iVerify Advanced Mobile Threat Report 2026: Mobile Spyware Shifts Toward Everyday Users as Criminal Groups Fork Leaked iOS Exploit Kits for Credential and Crypto Theft
• Kaspersky Q3 2026 Mobile Threat Statistics: Mamont/Creduz banker droppers, Triada/Vo1d preinstalled malware, AI-assisted Android fraud, DarkSword iOS exploit kit

Previous and next in malware

• Infostealer Activity Weekly Report (2026-11-02 to 2026-11-09): 12,382 Compromised Machines, Lumma/Warden/Vidar Previous report
• AI-agent-coordinated attacks and 575+ malicious OpenClaw skills delivering malware (Acronis TRU Cyber Pulse 2026) Next report