How to get rid of REVSTEALER malware

What kind of malware is REVSTEALER?

REVSTEALER is an information stealer designed to harvest credentials, session tokens, and sensitive data from infected Windows computers. According to research published by Elastic Security Labs, the malware is tracked internally as REF2859 and has been active for at least a year, with roughly 4,700 samples matched in a VirusTotal retrohunt.

REVSTEALER is built with gamers specifically in mind. It steals session data from platforms like Steam and Roblox alongside browser passwords and cryptocurrency wallets. Beyond credential theft, it can receive additional modules from its operator that add cryptocurrency mining, clipboard hijacking, and proxy tunneling to an already compromised machine.

REVSTEALER overview

Once installed, REVSTEALER quietly collects credentials from over 225 supported Chromium browser extensions - covering cryptocurrency wallet extensions and password managers - and from 51 standalone wallet applications. It also pulls saved passwords, browser cookies, and authentication data from popular web browsers.

The stealer captures system screenshots, clipboard content, environment variables, process listings, and installed-application data. Windows Sticky Notes, OBS Studio files, 2FA application data, and data from VPN clients and messaging apps are targeted as well.

All collected data is sent to the attacker's command-and-control (C2) server. REVSTEALER bypasses Chrome's App-Bound Encryption protection using a debugger-based technique, allowing it to extract credentials that newer browser versions were designed to protect.

Targeted gaming platforms

A notable aspect of REVSTEALER is its deliberate focus on gaming. It targets session cookies and configuration files for Steam, Roblox, Minecraft, Battle.net, EA Desktop, and Battlestate Games. Because gaming session cookies allow account access without a password, cybercriminals can resell hijacked accounts on underground markets.

The stealer supports a wide range of browser extensions, including cryptocurrency wallet extensions and password managers, along with standalone software wallets installed on the system. This mix of gaming account theft and wallet harvesting makes REVSTEALER particularly damaging for players who also hold cryptocurrency.

Follow-on modules

REVSTEALER can receive additional modules from its C2 server after the initial infection, significantly expanding what it can do. Four main modules have been documented by Elastic Security Labs.

ProManager focuses on cryptocurrency wallet theft, browser extension data, and phishing overlays that silently capture passwords as the user types them. WinUpdate monitors the clipboard and swaps copied cryptocurrency wallet addresses with ones controlled by the attacker.

SoftManager turns the infected machine into a reverse SOCKS5 proxy, routing attacker traffic through the victim's internet connection. LockAppHost deploys an XMRig miner and sets up persistence so the malware survives reboots.

Evasion and anti-analysis features

Most REVSTEALER samples are packed with VMProtect, making analysis and detection significantly harder. The malware also runs a weighted sandbox scoring system with ten environmental checks. If the combined score reaches seven or higher - based on factors such as CPU core count, RAM, GPU vendor, and system uptime - the malware terminates itself.

REVSTEALER skips systems in CIS-region countries by checking keyboard layout and language settings. It also uses indirect system calls to bypass user-mode hooks that security software relies on, and encrypts its internal strings to avoid plaintext detection.

C2 infrastructure and blockchain resilience

REVSTEALER uses a two-tier C2 strategy. When the primary server is reachable, it communicates there directly. If the primary server goes offline - for example, after a hosting-provider takedown - the malware queries up to five Polygon blockchain endpoints to retrieve a fallback C2 address.

Storing C2 data inside a public blockchain smart contract makes it far harder for defenders to disrupt the operation. The operator can update the contract with a new server address at any time, restoring contact with already-infected machines. This approach provides unusual resilience compared to most commodity stealers.

Conclusion

REVSTEALER is a capable and stealthy threat that combines credential theft, gaming account hijacking, and cryptocurrency wallet harvesting with an extensible module system. Victims can lose access to gaming accounts, have cryptocurrency transactions silently redirected, and find their computers mining for an attacker in the background.

Its blockchain-based fallback C2, VMProtect packing, and sophisticated sandbox-evasion system make it harder to detect and disrupt than many common stealers. Any infected system should be cleaned immediately with a reputable security tool.

More examples of stealers are LLHN, Vanta, and WARDEN.

How did REVSTEALER infiltrate my computer?

According to Elastic Security Labs, REVSTEALER is primarily spread through hijacked YouTube channels. Cybercriminals take over established accounts with real subscriber bases and post AI-generated videos promoting free game cheats, mod menus, and trainers. At least 17 channels have been used this way, directing viewers to malicious domains such as elitecheatsx[.]live and resight-cheats[.]net.

Files downloaded from those sites impersonate legitimate programs including Slack, qBittorrent, Steel Series GG, and Blender. The installers carry the REVSTEALER payload. Victims believe they are installing a game enhancement tool when they are in fact running malware.

More broadly, trojans and stealers also reach users via phishing emails, malicious advertisements, untrustworthy download sites, P2P networks, and pirated software or cracks.

How to avoid installation of malware?

Be cautious with any software promoted through YouTube videos, social media, or gaming forums - especially "free" cheats, mods, or cracked tools. Download software only from the official developer's website or a trusted platform. Avoid pirated content, key generators, and game trainers from unknown sources.

Keep your operating system and all installed programs up to date, and use a reputable security suite with real-time protection. If you believe that your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

Instant automatic malware removal:

Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:

By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.

Quick menu:

• What is REVSTEALER?
• STEP 1. Manual removal of REVSTEALER malware.
• STEP 2. Check if your computer is clean.

How to remove malware manually?

Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus for Windows.

If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:

If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:

Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:

Restart your computer into Safe Mode:

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup.

Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings".

Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".

In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

Video showing how to start Windows 10 in "Safe Mode with Networking":

Extract the downloaded archive and run the Autoruns.exe file.

In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.

Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.

You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".

After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.

Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.

These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software. To be sure your computer is free of malware infections, we recommend scanning it with Combo Cleaner Antivirus for Windows.

Frequently Asked Questions (FAQ)

My computer is infected with REVSTEALER malware, should I format my storage device to get rid of it?

Formatting the drive will remove REVSTEALER but also erase every file on it. Running a reputable security tool such as Combo Cleaner is the better first step - it can detect and eliminate the malware without destroying your data.

What are the biggest issues that REVSTEALER malware can cause?

REVSTEALER can steal saved passwords, browser cookies, and cryptocurrency wallet files, leading to account takeover and financial loss. It also targets gaming accounts on platforms like Steam and Roblox, which cybercriminals resell on underground markets.

Through its follow-on modules, the malware may silently redirect cryptocurrency transactions, mine digital currency using the victim's hardware, and route attacker traffic through the victim's internet connection.

What is the purpose of REVSTEALER malware?

REVSTEALER is designed to steal credentials and session data with a particular focus on gaming accounts and cryptocurrency wallets. Its extensible module system also allows operators to add clipboard hijacking, mining, and proxy capabilities after the initial infection.

How did REVSTEALER malware infiltrate my computer?

REVSTEALER has been distributed through hijacked YouTube channels advertising free game cheats or mod menus. Clicking the links in those videos leads to malicious sites where the payload is disguised as a legitimate program such as Slack or qBittorrent.

Will Combo Cleaner protect me from malware?

Yes. Combo Cleaner can detect and remove most known malware. Because REVSTEALER uses VMProtect packing and advanced evasion techniques, running a full system scan is recommended to make sure nothing is missed.