# RevStealer Windows Infostealer (Elastic REF2859) Uses 14 Indirect Syscalls and EtherHiding C2 to Steal Browser and Wallet Credentials

> RevStealer is a commercially sold Windows infostealer tracked by Elastic Security Labs as REF2859, spread through game-cheat lures (hijacked YouTube channels), a fake 'Claude Opus 5 Free Desktop' GitHub project and builds disguised as Slack, qBittorrent and SteelSeries GG. It uses indirect syscalls, a Chrome App-Bound Encryption bypass and Polygon smart-contract fallback C2 (EtherHiding) to steal browser, wallet, password-manager and gaming credentials.

- **Published:** 2026-11-10T05:25:12Z
- **Last reviewed:** 2026-11-10T05:25:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5613
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5613.png
- **ID:** TL-2026-5613
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 31 (3 shown free below)

## Description

RevStealer (stylised REVSTEALER) is a Windows infostealer first documented by Gen Threat Labs in July 2026 and analysed in depth by Elastic Security Labs on 2026-09-02, which tracks the activity as REF2859. Elastic's retrohunt matched about 4,733 unique files on VirusTotal between 2026-02-16 and 2026-08-27; this counts files, not confirmed victims. The stealer is reported to be sold commercially. No operator or group has been publicly identified; REF2859 is a tracking label, not an actor name. The CIS-locale exit check suggests, but does not prove, Russian-speaking operators.

Distribution relies on social engineering. Elastic found at least 17 YouTube channels (many hijacked, one with 24.4K subscribers) posting short AI-generated cheat/mod-menu demos that link to cheat-download sites such as elitecheatsx.live and resight-cheats.net. Akatsuki Legion (2026-11-09) reports more than 100 related domains selling cheats, boosters, HWID spoofers, fake AI tools and pirated software, though not every domain is confirmed as RevStealer distribution. Morphisec (2026-08-31) documented a fake 'Claude Opus 5 Free Desktop' GitHub project that copied Anthropic's branding and shipped a roughly 101 MB trojanized 64-bit Electron app; there is no indication Anthropic was compromised. Other samples masquerade as Slack, qBittorrent, SteelSeries GG and Blender, and are often VMProtect-packed.

The Electron loader runs with no UI, requires at least 2 GiB RAM and two logical CPUs, checks hostname, username and GPU, and wipes its encoded string table if a JavaScript debugger pause exceeds about 100 ms. It decrypts an AES-256-CBC resource, writes the native payload to a randomly named AppData folder, attempts to add that folder to Microsoft Defender exclusions, and launches it hidden. The native stage resolves APIs without an import table (FNV-1a hashing), uses 14 indirect syscall wrappers (it sorts ntdll Zw* exports by address, uses the index as the syscall number and jumps to a random syscall;ret gadget in ntdll), applies a weighted ten-check sandbox score (terminate at 7 or higher), exits on CIS language/keyboard settings, and in unpacked builds shows a six-character CAPTCHA-style gate. A vectored exception handler keeps remaining collectors running if one fails.

Theft covers Chromium and Firefox browser data, 225 Chromium extension IDs, 51 standalone wallet applications, password managers, VPN/FTP clients, messaging apps, 2FA tools, OBS profiles, Windows Credential Manager, clipboard, screenshots and gaming accounts (Steam, Battle.net, EA Desktop, Roblox, Minecraft launchers, Battlestate Games). Chrome App-Bound Encryption is bypassed by launching the browser under a debugger, setting a hardware breakpoint near the decryption code and reading the key from memory; Elastic assesses this was likely adapted from the public ChromeKatz/ElevationKatz project. The Roblox session cookie is decrypted to allow takeover without a password. Data is streamed as encrypted typed records over HTTPS/443. If the primary C2 is unreachable, the build queries up to five public Polygon JSON-RPC endpoints for its embedded smart-contract address and decrypts a fallback C2 with an embedded AES key (EtherHiding). The stealer reports completion, self-deletes and has no persistence, and can download and run additional executables.

Elastic also recovered four companion executables that share the stealer's packer, runtime function resolution and Polygon config approach: ProManager (wallet file/extension theft, overlays, input capture), WinUpdate (clipboard crypto-address replacement and mnemonic-shaped text collection), SoftManager (reverse SOCKS5 proxy over encrypted WebSocket) and LockAppHost (XMRig deployment with CMSTP elevation, Defender exclusions, disabling of 5 Windows Update services and 11 update plus 2 malware-removal scheduled tasks, miner hidden in suspended nslookup.exe or svchost.exe). Elastic did not observe any of the four delivered to a live RevStealer host; the link rests on shared code and investigative context. Note that GBHackers' mapping of module names to functions is inconsistent with Elastic and The Hacker News; this record follows the latter. The public Elastic YARA file does not cover LockAppHost.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1106 Native API
- T1027 Obfuscated Files or Information
- T1497.003 Time Based Checks
- T1622 Debugger Evasion
- T1685 Disable or Modify Tools
- T1564.003 Hidden Window
- T1070.004 File Deletion
- T1218.003 CMSTP
- T1555.003 Credentials from Web Browsers
- T1555.004 Windows Credential Manager
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1113 Screen Capture
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1090 Proxy
- T1496.001 Compute Hijacking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**RevStealer (REF2859) Lure Executable or Known Sample Hash Executed From User-Writable Path — Exploitation** (`TL-2026-5613-SPL-001`)

Detects execution of known RevStealer/REF2859 sample hashes (main stealer, resightloader.exe, SteelSeriesGG.exe, slack.exe, qBittorrent.exe lure builds from Elastic) or of the lure file names run from Downloads, Desktop, AppData\Local\Temp or AppData\Roaming instead of a normal install location. RevStealer is distributed through game-cheat lures and trojanized Electron builds masquerading as Slack, qBittorrent and SteelSeries GG, so the user-writable path plus lure name is the durable behavioural signal when hashes rotate. Maps to T1204.002 and T1027 (VMProtect-packed builds).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1027
- **Data sources:** sysmon, DeviceProcessEvents, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 | eval hash_hit=if(match(Hashes,"(?i)(adc4aa652965396b52e79435ca54987ae9eb21bf5e67de5e9461b09655165ee4|4c897108e8e793d6904110928c996815c302d6975c9bc61162149e855a963d50|8b33e0f32c42a317e3d9cd67d5a6dc68e91a6cf9dd44742162858e7d83cf2073|bd97d5cab2d09b001d1b9e08890bce1a2b2cf8542a4b31c86b2def59328cafb2|1617552169df805405b1bb70f742d6eac5af342f31c6e39ff6b9613bd2392354)"),1,0) | eval lure_name=if(match(Image,"(?i).(slack|qbittorrent|steelseriesgg|resightloader)[.]exe$"),1,0) | eval user_path=if(match(Image,"(?i)Users.+(Downloads|Desktop|AppData.Local.Temp|AppData.Roaming)"),1,0) | eval legit_install=if(match(Image,"(?i)(Program Files|AppData.Local.slack|WindowsApps)"),1,0) | where hash_hit=1 OR (lure_name=1 AND user_path=1 AND legit_install=0) | stats count min(_time) as first_seen max(_time) as last_seen values(ParentImage) as parent_image values(CommandLine) as command_line by host, User, Image, Hashes | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let ioc_sha256 = dynamic(["adc4aa652965396b52e79435ca54987ae9eb21bf5e67de5e9461b09655165ee4","4c897108e8e793d6904110928c996815c302d6975c9bc61162149e855a963d50","8b33e0f32c42a317e3d9cd67d5a6dc68e91a6cf9dd44742162858e7d83cf2073","bd97d5cab2d09b001d1b9e08890bce1a2b2cf8542a4b31c86b2def59328cafb2","1617552169df805405b1bb70f742d6eac5af342f31c6e39ff6b9613bd2392354"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where SHA256 in~ (ioc_sha256)
    or (FileName in~ ("slack.exe", "qbittorrent.exe", "steelseriesgg.exe", "resightloader.exe")
        and FolderPath has_any ("Downloads", "Desktop", "AppData")
        and not(FolderPath contains "Program Files")
        and not(FolderPath contains "Local\\slack"))
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: RevStealer Lure Executable or Known REF2859 Hash Executed From User-Writable Path
id: 7c1f3a52-8d4e-4b6a-9e21-5a0c3d7f1b84
status: experimental
description: Detects known RevStealer/REF2859 sample hashes, or Slack, qBittorrent, SteelSeries GG and resightloader executables running from Downloads, Desktop or AppData instead of a legitimate install path.
references:
  - https://www.elastic.co/security-labs/threat-command/revstealer-credential-harvesting-infostealer
  - https://github.com/elastic/labs-releases/tree/main/indicators/revstealer
author: Threadlinqs Team
date: 2026/11/10
tags:
  - attack.execution
  - attack.t1204.002
  - attack.defense-evasion
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_hash:
    Hashes|contains:
      - 'adc4aa652965396b52e79435ca54987ae9eb21bf5e67de5e9461b09655165ee4'
      - '4c897108e8e793d6904110928c996815c302d6975c9bc61162149e855a963d50'
      - '8b33e0f32c42a317e3d9cd67d5a6dc68e91a6cf9dd44742162858e7d83cf2073'
      - 'bd97d5cab2d09b001d1b9e08890bce1a2b2cf8542a4b31c86b2def59328cafb2'
      - '1617552169df805405b1bb70f742d6eac5af342f31c6e39ff6b9613bd2392354'
  selection_name:
    Image|endswith:
      - '\slack.exe'
      - '\qbittorrent.exe'
      - '\steelseriesgg.exe'
      - '\resightloader.exe'
  selection_path:
    Image|contains:
      - '\Downloads\'
      - '\Desktop\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
  filter_legit:
    Image|contains:
      - '\Program Files'
      - '\AppData\Local\slack\'
  condition: selection_hash or (selection_name and selection_path and not filter_legit)
fields:
  - Image
  - CommandLine
  - ParentImage
  - Hashes
falsepositives:
  - Legitimate portable Slack, qBittorrent or SteelSeries builds run from Downloads
level: high
```

**Known false positives:**

- Legitimate portable builds of Slack, qBittorrent or SteelSeries GG run from the Downloads folder
- Users who download official installers and run them before installation completes

**Tuning notes:** Allowlist the paths and signers of your sanctioned Slack, qBittorrent and SteelSeries deployments. Add new sample hashes from Elastic's indicator repository as they are published. Require the process to be unsigned if your telemetry includes signature status.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- RevStealer Cheat-Site and Lure-Archive Distribution Contact — Exploitation (locked: unlock with TL Creds)
- RevStealer Browser, Roblox Cookie and Credential Store Theft Including ABE Bypass Browser Launch — Post-Exploitation (locked: unlock with TL Creds)
- RevStealer Primary and Module C2 Domain Connections From Endpoint — C2 (locked: unlock with TL Creds)
- Fake 'Claude Opus 5 Free Desktop' Trojanized Electron App Execution — Exploitation (locked: unlock with TL Creds)
- RevStealer-Linked LockAppHost Miner Deployment: CMSTP Elevation, Windows Update Disablement, Hidden Miner Process — Post-Exploitation (locked: unlock with TL Creds)
- RevStealer Known and Pattern-Matched polygon.* C2 Hostname DNS Resolution — C2 (locked: unlock with TL Creds)
- RevStealer Microsoft Defender Exclusion for AppData Path With Hidden Launch — Post-Exploitation (locked: unlock with TL Creds)
- RevStealer EtherHiding Polygon RPC Dead-Drop Lookups From Non-Browser User-Path Process — C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 31)

Defanged, TLP:CLEAR.

- Domain: `elitecheatsx[.]live`
- File hash: `adc4aa652965396b52e79435ca54987ae9eb21bf5e67de5e9461b09655165ee4`
- Domain: `resight-cheats[.]net`

Full set of 31 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [REVSTEALER ramps up: analysis of up-and-coming infostealer (Elastic Security Labs)](https://www.elastic.co/security-labs/threat-command/revstealer-credential-harvesting-infostealer)
- [Four REVSTEALER-linked modules disable Windows Update and Defender (The Hacker News)](https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html)
- [Inside RevStealer's growing distribution ecosystem (Akatsuki Legion)](https://akatsukilegion.com/post.php?slug=inside-revstealer-s-growing-distribution-ecosystem)
- [Morphisec RevStealer Threat Analysis (fake Claude Opus 5 desktop app)](https://engage.morphisec.com/hubfs/2026-PDFs/RevStealer_ThreatAnalysis_5.pdf)
- [Fake Claude Opus 5 App Delivers RevStealer (GBHackers)](https://gbhackers.com/fake-claude-opus-5-app/)
- [RevStealer Bypasses Security Monitoring With 14 Indirect Syscalls to Steal Browser and Wallet Credentials (GBHackers)](https://gbhackers.com/revstealer-malware-attack/)
- [Elastic Labs releases: RevStealer indicators](https://github.com/elastic/labs-releases/tree/main/indicators/revstealer)
- [ChromeKatz (public App-Bound Encryption bypass tooling)](https://github.com/Meckazin/ChromeKatz)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5613