Threat video1:00
RevStealer EtherHiding Infostealer: Detection & IOCs
RevStealer uses Polygon smart contracts as fallback C2 and 14 indirect syscalls. Includes 9 detection rules (one free in Splunk SPL) and 31 IOCs.
Read the full threat intel for RevStealer EtherHiding Infostealer: Detection & IOCs →
Chapters
- 0:00The hookAbout 4,733 files matched RevStealer.
- 0:05The storyBuilds pose as Slack or Blender.
- 0:11Attack pathLures on cheat and fake apps.
- 0:23AttributionNo threat actor is attributed.
- 0:28Indicators of compromise26 indicators to hunt: 12 domains, 9 SHA-256 hashes and 4 MD5 hashes, and more.
- 0:38MITRE ATT&CK techniques19 ATT&CK techniques, from initial access to impact.
- 0:43Remediation4 steps now: Block the listed distribution, C2 and module C2 domains.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 4,733 files matched RevStealer.
0:05Builds pose as Slack or Blender.
0:07Then it steals credentials.
0:11Lures on cheat and fake apps.
0:13It seeks a Defender exclusion.
0:15It takes session cookies.
0:17Backup server read from Polygon contract.
0:24No threat actor is attributed. Confidence: low.
0:2826 indicators to hunt: 12 domains, 9 SHA-256 hashes and 4 MD5 hashes, and more.
0:3919 ATT&CK techniques, from initial access to impact.
0:444 steps now: Block the listed distribution, C2 and module C2 domains.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.