RevStealer Is Built to Be Silent
RevStealer is a Windows information stealer delivered via a trojanized Electron application distributed on GitHub. The malware employs anti-VM, anti-debugging, and indirect syscall techniques to evade analysis and detection. It exfiltrates data in a single burst and uses a Polygon blockchain smart contract for C2 failover.
Detection / Hunteropenrouter
What Happened
A type of malicious software called RevStealer is targeting Windows computers by disguising itself as a free AI chatbot application. Once installed, it steals sensitive data like passwords, browser cookies, and cryptocurrency wallets. The software is designed to avoid detection by automated security tools by checking the computer's hardware and blocking debugging, and it can switch its communication servers using blockchain technology. Individuals and organizations should be cautious of free software downloads from GitHub and ensure their security tools are capable of catching this type of evasion.
Key Takeaways
- RevStealer is distributed through a fake 'Claude Opus 5 Free Desktop' GitHub repository, exploiting demand for AI tooling as a social engineering surface.
- The Electron loader validates memory, CPU, hostname, and GPU metrics before decrypting the AES-256-CBC payload to evade sandbox analysis.
- The native payload resolves Windows APIs without an import table and uses 14 indirect syscall wrappers to bypass user-mode monitoring hooks.
- If the primary C2 is unreachable, RevStealer reads a fallback address from a Polygon blockchain smart contract to rotate infrastructure.
- The malware executes a single short burst of theft with no persistence mechanisms, making post-execution detection structurally too late.
Affected Systems
- Windows
- Electron desktop applications
- Browser databases
- Cryptocurrency wallets
- Password managers
- VPN configurations
- Windows Credential Manager
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Victim downloads a trojanized Electron application from a GitHub repository impersonating Anthropic.
- Defense Evasion: The loader checks host memory, CPU, GPU, and debugger timing before decrypting an AES-256-CBC payload.
- Execution: The payload is written to a random directory under AppData and launched hidden and detached.
- Defense Evasion: The native payload runs anti-VM checks, regional checks, and uses indirect syscalls to bypass monitoring.
- Collection: Credentials, browser data, and cryptocurrency wallets are collected and streamed out without creating on-disk archives.
- Exfiltration: Data is exfiltrated to the C2 server, with a Polygon smart contract used for failover. The malware self-deletes.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article mentions a full indicator set is available in a downloadable PDF, but no rules or queries are provided in the blog text.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The malware uses indirect syscalls to bypass user-mode hooks and checks for analysis environments. It self-deletes after a short burst, leaving a thin evidentiary footprint. |
| Network Visibility | Low | The C2 address can be rotated via a Polygon blockchain smart contract, complicating seizure-based disruption. Exfiltration is streamed, not staged. |
| Detection Difficulty | Hard | The malware is designed to evade automated analysis through hardware checks, anti-debugging, and anti-VM logic. It uses indirect syscalls and encrypted payloads. |
Required Log Sources
- Sysmon (Process creation, File creation)
- EDR telemetry
- DNS logs
- Windows Defender exclusion logs
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Monitor for processes adding folders to the Microsoft Defender exclusion list, particularly from unexpected or unsigned applications. | EDR, Windows Defender events | Defense Evasion | Medium - system administrators sometimes add exclusions for legitimate software. |
| Look for Electron applications that execute hidden child processes from the AppData directory without displaying a user interface. | EDR, Sysmon | Execution | Low - standard apps usually display a UI. |
| Identify network connections originating from unusual processes that resolve Polygon blockchain RPC endpoints. | Network firewall, EDR network events | Command and Control | Low - standard users rarely query smart contracts. |
Control Gaps
- Signature-based AV
- Automated sandboxes
- Network-level blocking without blockchain endpoint visibility
Key Behavioral Indicators
- Electron process spawning hidden child processes
- Add-MpPreference execution from unexpected contexts
- Processes querying blockchain RPC APIs
- Applications checking timing around JavaScript debugger statements
False Positive Assessment
Low to Medium. Legitimate administrative actions might add Defender exclusions, and some legitimate apps use Electron, but the combination of hidden window, AppData execution, and Defender exclusion modification is highly suspicious.
Recommendations
Immediate Mitigation
- Verify against your organization's incident response runbook and team escalation paths before acting.
- Consider restricting execution of applications from untrusted GitHub repositories or game-cheat sites.
- Evaluate whether blocking Microsoft Defender exclusion modifications via Group Policy is appropriate for your environment.
Infrastructure Hardening
- Consider monitoring or blocking access to Polygon RPC endpoints for standard workstations if supported by your network controls.
User Protection
- If your EDR supports behavioral blocking, evaluate whether it can detect indirect syscalls or hidden child processes from Electron apps.
Security Awareness
- Remind users that demand for AI tools is being used as a social engineering lure. Verify the authenticity of software, especially free versions of paid tools.
MITRE ATT&CK Mapping
Execution
Exfiltration
Additional IOCs
- Command Lines:
- Purpose: Attempt to add the user's AppData folder to Microsoft Defender exclusion list | Tools:
powershell.exe| Stage: Defense Evasion |Add-MpPreference -ExclusionPath
- Purpose: Attempt to add the user's AppData folder to Microsoft Defender exclusion list | Tools:
