Top Tweets for #RevStealer

REVSTEALER infostealer tracked under REF2859 combines blockchain-based C2 resilience, a weighted sandbox scoring system, and four follow-on modules including a cryptominer and SOCKS5 proxy, with roughly 4,700 samples on VirusTotal over the past year. - Distribution runs through hijacked YouTube channels posting AI-generated game-cheat videos pointing to elitecheatsx[.]live and resight-cheats[.]net, but lure themes extend well beyond gaming: VirusTotal submissions impersonate Slack, qBittorrent, Blender, and SteelSeries GG, all packed with VMProtect. Sha-256 samples include 8b33e0f32c42a317e3d9cd67d5a6dc68e91a6cf9dd44742162858e7d83cf2073 (SteelSeriesGG.exe) and bd97d5cab2d09b001d1b9e08890bce1a2b2cf8542a4b31c86b2def59328cafb2 (slack.exe). - The sandbox scoring system runs ten weighted checks (CPU cores, RAM, GPU vendor, uptime, CPUID, virtualization, and more). A score of 7 or higher triggers self-termination. CIS locale checks via FNV-1a hash comparison fire before any stealing begins, also killing the process on a match. - App-Bound Encryption bypass uses debugger-controlled browser process launch with a hardware breakpoint to read the decrypted key from memory, based on the public ElevationKatz/ChromeKatz project. Gaming targets include Roblox session cookies at %LOCALAPPDATA%\Roblox\LocalStorage\RobloxCookies.dat, Steam login files, and https://t.co/L0wf54RHS0 configs. #DFIR_Radar