Threat video1:00
RevStealer 100+ Domains Infostealer: Detection & IOCs
RevStealer spreads via 100+ cheat and fake-app domains and reads its C2 from Polygon: 9 detection rules, 29 IOCs and a free Splunk SPL rule.
Read the full threat intel for RevStealer 100+ Domains Infostealer: Detection & IOCs →
Chapters
- 0:00The hookAbout 4,700 samples, aimed at gamers
- 0:04The storyIt spreads over 100+ domains.
- 0:10Attack pathVictims run a ZIP lure
- 0:24AttributionNo threat actor is attributed.
- 0:28Indicators of compromise25 indicators to hunt: 14 domains, 10 SHA-256 hashes and 1 MD5 hash.
- 0:38MITRE ATT&CK techniques20 ATT&CK techniques, from execution to impact.
- 0:43Remediation4 steps now: Block the hub, C2 and related distribution domains listed.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 4,700 samples, aimed at gamers
0:05It spreads over 100+ domains.
0:07Some YouTube channels promote it.
0:11Victims run a ZIP lure
0:13Stage 1 is VMProtect-packed
0:15It checks for sandboxes, then takes passwords
0:19Records stream to C2, then it self-deletes
0:24No threat actor is attributed. Confidence: low.
0:2925 indicators to hunt: 14 domains, 10 SHA-256 hashes and 1 MD5 hash.
0:3920 ATT&CK techniques, from execution to impact.
0:444 steps now: Block the hub, C2 and related distribution domains listed.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.