#ParsedReport #CompletenessHigh
02-09-2026

REVSTEALER ramps up: analysis of up-and-coming infostealer

https://www.elastic.co/security-labs/threat-command/revstealer-credential-harvesting-infostealer

Report completeness: High

Threats:
Revstealer
Dead_drop_technique
Etherhiding_technique
Vmprotect_tool
Lumma_stealer
Aurastealer
Sandbox_evasion_technique
Credential_harvesting_technique
Elevationkatz_tool
Chromekatz_tool
Xmrig_miner

Victims:
Gaming, Cryptocurrency wallets, Browsers, Vpn applications, Chat applications, Password managers, Gaming platforms, Ftp clients, Obs studio, Two factor authentication applications, have more...

Industry:
Entertainment

TTPs:
Tactics: 8
Technics: 0

IOCs:
Domain: 9
Hash: 9
File: 2
Coin: 7
Path: 4

Soft:
Slack, qBittorrent, Chromium, Steam, Roblox, Minecraft

Algorithms:
aes, sha256, fnv-1a

Win API:
Polygon, GetEnvironmentStringsW, OpenClipboard, GetClipboardData, CryptUnprotectData

YARA: Found

Links:
https://github.com/elastic/detection-rules/blob/main/rules/windows/command\_and\_control\_dns\_susp\_tld.toml
https://github.com/elastic/labs-releases/blob/main/tools/revstealer/ida\_decrypt\_strings.py
https://github.com/Meckazin/ChromeKatz
have more...