THREAT OPS › Threat News › REVSTEALER ramps up: analysis of up-and-coming infostealer
REVSTEALER ramps up: analysis of up-and-coming infostealer
<p>Elastic Security Labs is tracking an emerging infostealer, REVSTEALER, under REF2859. This family has gained momentum in recent months, with higher distribution volume, and has emerged as a formidable threat, featuring a comprehensive credential harvester, an embedded sandbox scoring system, and a Polygon blockchain-based dead drop for resilience. Beyond credential theft, REVSTEALER targets gam
MITRE ATT&CK techniques
- Screen CaptureT1113
- Malicious FileT1204.002
- Browser ExtensionsT1176.001
- Clipboard DataT1115
- Password ManagersT1555.005
- System Information DiscoveryT1082
- Native APIT1106
- Credentials from Password StoresT1555
- Time Based ChecksT1497.003
- Credentials from Web BrowsersT1555.003
- Browser Information DiscoveryT1217
- Automated ExfiltrationT1020
- Indicator RemovalT1070
- File and Directory DiscoveryT1083
- Virtualization/Sandbox EvasionT1497
- Web ServiceT1102
- User ExecutionT1204
- Input CaptureT1056
- CredentialsT1589.001
- File DeletionT1070.004
- Malicious LinkT1204.001
- Dead Drop ResolverT1102.001
- Malicious LinkAML.T0011.003
- Virtualization/Sandbox EvasionAML.T0097
Indicators of compromise
- 8b33e0f32c42a317e3d9cd67d5a6dc68e91a6cf9dd44742162858e7d83cf2073sha256
- f07666ac22dfa1a361b8a8576baf69eadaf15431db9f3c34e93334d8d2f8d691sha256
- bd97d5cab2d09b001d1b9e08890bce1a2b2cf8542a4b31c86b2def59328cafb2sha256
- 5c30efd5b9ff75023c3813705f5c47feccc496f439b24b3e572db4c3b08dffe3sha256
- 1617552169df805405b1bb70f742d6eac5af342f31c6e39ff6b9613bd2392354sha256
- 83f5b4ca629681abab2b9680472a304572a8c91b4a8ccc1189fbf58c6186db09sha256
- 4c897108e8e793d6904110928c996815c302d6975c9bc61162149e855a963d50sha256
- adc4aa652965396b52e79435ca54987ae9eb21bf5e67de5e9461b09655165ee4sha256
- 14b2ac356ed75d10ef40bbaaa48e7dd9fff7de9719c2a43ad123fe843dd4e4e2sha256
- 7c08cf409194056a8517865e5d3433d1499bb8262263b55b49b8b07d9d182fcbsha256
- 13d7237d7289e67c2d806a65d52580b453ce4987acbe2c4c4d04833f55ebccfasha256
- c66d2b77b9e85c53391891212413ad9a99eb66f4b11c6a431e78884a5b2651e5sha256
- 0x7e4126ADFE6679B3613F629CD49162Fb08fc53Bdeth
- 0x0EC6a6D31b36271eBD06450EA98c84eBa8a191d5eth
- 0x49cE5712164755ed212209bc71539bBc6fCFF541eth
- 0x98FF8e7cdC13AE46b83B7590B986F25f1560DF03eth
- 0x0cF1Ec8B9551103de729c3b02D77221Da9d81Acceth
- 0x0E04c59f31E382D2B8A1637f4B9A5f04165EC48deth
- 0xC4eC9B7be1c2A0B39Eca678673DcB9164CA5df53eth
- static-www.elastic.codomain
- resight-cheats.netdomain
- polygon.iwmukj.xyzdomain
- polygon.mnyhgxda.xyzdomain
- battle.netdomain