Four REVSTEALER-linked modules disable Windows Update and Defender to run a crypto miner

Elastic Security Labs documented four previously unreported programs associated with REVSTEALER: ProManager, WinUpdate, SoftManager, and LockAppHost. Unlike the core stealer, which deletes itself after exfiltration, these programs remain on the infected machine. LockAppHost disables Windows Update and Microsoft Defender protections before running a cryptocurrency miner. REVSTEALER steals browser passwords and cookies, cryptocurrency wallet data, gaming-account data, messaging data, and files.