{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "REVSTEALER uses resilient blockchain infrastructure to maintain persistent account access for theft. A negative result confirms that session cookies for critical platforms have not been harvested from the enrolled estate."
      },
      "name": "REVSTEALER: Credential Theft and Follow-on Impact",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1555",
        "attack.t1176",
        "attack.t1496",
        "attack.t1133",
        "attack.t1115",
        "attack.t1566"
      ],
      "series": {
        "slug": "revstealer-ramps-up-analysis-of-up-and-coming-infostealer",
        "index": 2,
        "title": "REVSTEALER ramps up: analysis of up-and-coming infostealer",
        "total": 2
      },
      "related": [
        {
          "hunt": "revstealer-victim-profiling",
          "reason": "Victim profiling and CIS discovery checks are distinct behaviors covered in a separate profiling hunt.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A simple rule on Polygon RPC endpoints would be too noisy for common crypto users. This hunt joins those network signals with rare process execution and specific gaming configuration file access to create a high-confidence behavioral picture.",
      "coverage": [
        {
          "stage": "credential-and-gaming-data-theft",
          "steps": [
            "gaming-config-theft"
          ],
          "status": "covered"
        },
        {
          "stage": "c2-polygon-dead-drop",
          "steps": [
            "c2-dns-resolutions"
          ],
          "status": "covered"
        },
        {
          "stage": "follow-on-module-delivery",
          "steps": [
            "follow-on-modules"
          ],
          "status": "covered"
        },
        {
          "stage": "initial-access-social-engineering",
          "reason": "Belongs to another part of the 'REVSTEALER ramps up: analysis of up-and-coming infostealer' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "anti-analysis-and-evasion",
          "reason": "Belongs to another part of the 'REVSTEALER ramps up: analysis of up-and-coming infostealer' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "victim-profiling-and-discovery",
          "reason": "Belongs to another part of the 'REVSTEALER ramps up: analysis of up-and-coming infostealer' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Social Engineering via YouTube and Trojanized Software",
            "slug": "initial-access-social-engineering",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "elitecheatsx.live",
              "resight-cheats.net",
              "SteelSeriesGG.exe",
              "slack.exe",
              "qBittorrent.exe"
            ]
          },
          {
            "name": "Evasion and Sandbox Scoring",
            "slug": "anti-analysis-and-evasion",
            "tactic": "defense-evasion",
            "observables": [
              "VMProtect packer",
              "FNV-1a hash lookups",
              "6-character token verification window",
              "indirect syscalls"
            ]
          },
          {
            "name": "System Profiling and Information Discovery",
            "slug": "victim-profiling-and-discovery",
            "tactic": "discovery",
            "techniques": [
              "T1115"
            ],
            "observables": [
              "GetEnvironmentStringsW",
              "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
              "OpenClipboard",
              "GetClipboardData",
              "screenshot capture"
            ]
          },
          {
            "name": "Credential and Gaming Account Harvesting",
            "slug": "credential-and-gaming-data-theft",
            "tactic": "credential-access",
            "techniques": [
              "T1555",
              "T1176"
            ],
            "observables": [
              "Chromium App-Bound Encryption bypass",
              "%LOCALAPPDATA%\\Battle.net\\Battle.net.config",
              "Robloxcookies.dat",
              "local.vdf",
              "loginusers.vdf",
              "225 Chromium extension identifiers"
            ]
          },
          {
            "name": "C2 Communication and Polygon Fallback",
            "slug": "c2-polygon-dead-drop",
            "tactic": "command-and-control",
            "observables": [
              "polygon.iwmukj.xyz",
              "polygon.mnyhgxda.xyz",
              "static4.livelab.one",
              "0x7e4126ADFE6679B3613F629CD49162Fb08fc53Bd",
              "0x0EC6a6D31b36271eBD06450EA98c84eBa8a191d5"
            ]
          },
          {
            "name": "Resource Hijacking and Proxy Modules",
            "slug": "follow-on-module-delivery",
            "tactic": "impact",
            "techniques": [
              "T1496",
              "T1133"
            ],
            "observables": [
              "ProManager",
              "WinUpdate",
              "SoftManager",
              "LockAppHost",
              "XMRig"
            ]
          }
        ],
        "summary": "REVSTEALER is an emerging infostealer distributed through social engineering and trojanized installers for software like Slack and qBittorrent, using a custom sandbox scoring system and Polygon blockchain dead drops for C2 resilience. The malware specifically targets gaming platforms, cryptocurrency wallets, and browser credentials\u2014including a bypass for Chromium's App-Bound Encryption\u2014and can deploy additional modules for cryptomining and proxying."
      },
      "severity": "high",
      "rationale": "Focus on workstations where users have gaming software installed alongside corporate applications like Slack. Narrow to hosts where lure software (qBittorrent, Blender) has been recently launched.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An intruder has deployed an infostealer to harvest credentials from gaming and communication platforms, utilizing blockchain-based fallback infrastructure to maintain C2 and deploying impact modules like miners and proxies.",
      "parameters": {
        "c2_domains": {
          "from": {
            "ref": "elastic-security-labs",
            "kind": "article",
            "observed": "2026-09-02"
          },
          "type": "list[domain]",
          "default": [
            "elitecheatsx.live",
            "resight-cheats.net",
            "polygon.iwmukj.xyz",
            "polygon.mnyhgxda.xyz",
            "static4.livelab.one"
          ],
          "description": "Known primary C2 and Polygon dead-drop domains."
        },
        "scope_hosts": {
          "from": {
            "ref": "default",
            "kind": "manual",
            "observed": "2026-09-02"
          },
          "type": "list[host]",
          "default": [],
          "description": "Optional list of hosts to narrow the hunt; defaults to all."
        },
        "module_names": {
          "from": {
            "ref": "elastic-security-labs",
            "kind": "article",
            "observed": "2026-09-02"
          },
          "type": "list[string]",
          "default": [
            "promanager.exe",
            "winupdate.exe",
            "softmanager.exe",
            "lockapphost.exe",
            "xmrig.exe"
          ],
          "description": "Names of follow-on modules delivered via REVSTEALER tasking."
        },
        "lookback_days": {
          "from": {
            "ref": "default",
            "kind": "manual",
            "observed": "2026-09-02"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "target_software": {
          "from": {
            "ref": "elastic-security-labs",
            "kind": "article",
            "observed": "2026-09-02"
          },
          "type": "list[string]",
          "default": [
            "slack",
            "steam",
            "battle.net",
            "qbittorrent",
            "roblox",
            "blender",
            "steelseries"
          ],
          "description": "Software names associated with REVSTEALER lures or targets."
        },
        "gaming_config_files": {
          "from": {
            "ref": "elastic-security-labs",
            "kind": "article",
            "observed": "2026-09-02"
          },
          "type": "list[string]",
          "default": [
            "battle.net.config",
            "robloxcookies.dat",
            "local.vdf",
            "loginusers.vdf"
          ],
          "description": "Filenames of gaming configuration files targeted for harvesting."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.elastic.co/security-labs/threat-command/revstealer-credential-harvesting-infostealer",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.elastic.co/security-labs/threat-command/revstealer-credential-harvesting-infostealer",
          "name": "REVSTEALER ramps up: analysis of up-and-coming infostealer"
        }
      ],
      "blind_spots": [
        {
          "id": "abe-bypass-monitoring",
          "risk": "Traditional file access rules miss the memory-based bypass of browser security, allowing silent extraction of browser-bound keys.",
          "stage": "credential-and-gaming-data-theft",
          "question": "Was App-Bound Encryption bypassed via hardware breakpoints?",
          "requires": "hb_module_activity with debugger-specific eventing"
        },
        {
          "id": "decrypted-c2-visibility",
          "risk": "The adversary rotates the final C2 server using a smart contract, meaning static DNS/IP lists will fail to observe the new infrastructure.",
          "stage": "c2-polygon-dead-drop",
          "question": "What is the final C2 destination after smart-contract decryption?",
          "requires": "HTTP decryption or memory analysis"
        }
      ]
    },
    "name": "REVSTEALER: Credential Theft and Follow-on Impact",
    "description": "This hunt targets the core stealing behavior and resilience mechanisms of REVSTEALER. It identifies hosts with targeted gaming or communication software, then correlates this with evidence of sensitive configuration file access, DNS resolutions to Polygon-based dead-drop infrastructure, and the execution of task-delivered impact modules like XMRig. An agent weighs these signals together to identify active account takeovers and resource hijacking across the fleet."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "revstealer-ramps-up-analysis-of-up-and-coming-infostealer",
          "index": 2,
          "title": "REVSTEALER ramps up: analysis of up-and-coming infostealer",
          "total": 2
        },
        "coverage": [
          {
            "stage": "credential-and-gaming-data-theft",
            "steps": [
              "gaming-config-theft"
            ],
            "status": "covered"
          },
          {
            "stage": "c2-polygon-dead-drop",
            "steps": [
              "c2-dns-resolutions"
            ],
            "status": "covered"
          },
          {
            "stage": "follow-on-module-delivery",
            "steps": [
              "follow-on-modules"
            ],
            "status": "covered"
          },
          {
            "stage": "initial-access-social-engineering",
            "reason": "Belongs to another part of the 'REVSTEALER ramps up: analysis of up-and-coming infostealer' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "anti-analysis-and-evasion",
            "reason": "Belongs to another part of the 'REVSTEALER ramps up: analysis of up-and-coming infostealer' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "victim-profiling-and-discovery",
            "reason": "Belongs to another part of the 'REVSTEALER ramps up: analysis of up-and-coming infostealer' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An intruder has deployed an infostealer to harvest credentials from gaming and communication platforms, utilizing blockchain-based fallback infrastructure to maintain C2 and deploying impact modules like miners and proxies.",
        "blind_spots": [
          {
            "id": "abe-bypass-monitoring",
            "risk": "Traditional file access rules miss the memory-based bypass of browser security, allowing silent extraction of browser-bound keys.",
            "stage": "credential-and-gaming-data-theft",
            "question": "Was App-Bound Encryption bypassed via hardware breakpoints?",
            "requires": "hb_module_activity with debugger-specific eventing"
          },
          {
            "id": "decrypted-c2-visibility",
            "risk": "The adversary rotates the final C2 server using a smart contract, meaning static DNS/IP lists will fail to observe the new infrastructure.",
            "stage": "c2-polygon-dead-drop",
            "question": "What is the final C2 destination after smart-contract decryption?",
            "requires": "HTTP decryption or memory analysis"
          }
        ],
        "scoping_notes": "Focus on workstations where users have gaming software installed alongside corporate applications like Slack. Narrow to hosts where lure software (qBittorrent, Blender) has been recently launched.",
        "beyond_detection": "A simple rule on Polygon RPC endpoints would be too noisy for common crypto users. This hunt joins those network signals with rare process execution and specific gaming configuration file access to create a high-confidence behavioral picture."
      }
    },
    {
      "id": "target-software-inventory",
      "type": "query",
      "label": "Inventory of targeted software",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT device_hostname, package_name, vendor_name FROM hb_software_inventory WHERE (instr(',' || '{{target_software}}' || ',', ',' || LOWER(package_name) || ',') > 0)",
        "surface": "hb_software_inventory",
        "description": "Identify endpoints where software that REVSTEALER targets or impersonates is installed to narrow the scope of the investigation.",
        "expected_signal": "Hosts with Steam, Battle.net, Slack, or other lure software. Silence means no such software is indexed in the inventory."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Inventory of targeted software",
        "reads": [
          "device_hostname",
          "package_name",
          "vendor_name"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT DISTINCT device_hostname, package_name, vendor_name FROM hb_software_inventory WHERE (instr(',' || '{{target_software}}' || ',', ',' || LOWER(package_name) || ',') > 0)",
        "silence": "not_evidence_of_absence",
        "expected": "Hosts with Steam, Battle.net, Slack, or other lure software. Silence means no such software is indexed in the inventory.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "gaming-config-theft",
      "type": "query",
      "label": "Sensitive gaming configuration access",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, file_name, file_path, process_name, time FROM hb_file_activity WHERE instr(',' || '{{gaming_config_files}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_file_activity",
        "description": "Find processes reading the specific configuration files targeted by REVSTEALER for account takeover.",
        "expected_signal": "Processes other than the legitimate game engine reading these files indicate potential credential theft."
      },
      "parents": [
        {
          "id": "target-software-inventory"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Sensitive gaming configuration access",
        "reads": [
          "device_hostname",
          "file_name",
          "file_path",
          "process_name",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, file_name, file_path, process_name, time FROM hb_file_activity WHERE instr(',' || '{{gaming_config_files}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Processes other than the legitimate game engine reading these files indicate potential credential theft.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "c2-dns-resolutions",
      "type": "query",
      "label": "C2 and Polygon infrastructure resolutions",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_dns_activity",
        "description": "Identify DNS activity to known REVSTEALER C2 servers and Polygon smart-contract RPC endpoints.",
        "expected_signal": "Resolutions to the malicious domains. Silence is not proof of absence if new smart contracts or RPCs are in use."
      },
      "parents": [
        {
          "id": "target-software-inventory"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "C2 and Polygon infrastructure resolutions",
        "reads": [
          "device_hostname",
          "process_name",
          "query_hostname",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Resolutions to the malicious domains. Silence is not proof of absence if new smart contracts or RPCs are in use.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "follow-on-modules",
      "type": "query",
      "label": "Execution of follow-on impact modules",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT LOWER(process_name) AS p_name, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE instr(',' || '{{module_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_name) HAVING hosts <= 3",
        "surface": "hb_process_activity",
        "description": "Identify the execution of rare modules delivered via REVSTEALER tasks to find malicious payloads like XMRig.",
        "expected_signal": "Execution of named modules on a very small subset of hosts. Higher counts may indicate legitimate software."
      },
      "parents": [
        {
          "id": "target-software-inventory"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Execution of follow-on impact modules",
        "reads": [
          "device_hostname",
          "process_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT LOWER(process_name) AS p_name, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE instr(',' || '{{module_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_name) HAVING hosts <= 3",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Execution of named modules on a very small subset of hosts. Higher counts may indicate legitimate software.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "process_name"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "agent-triage",
      "type": "analytic",
      "label": "Triage REVSTEALER evidence",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint"
        ],
        "context": [
          "target-software-inventory",
          "gaming-config-theft",
          "c2-dns-resolutions",
          "follow-on-modules"
        ],
        "objective": "Determine if any host shows overlapping evidence of sensitive configuration theft, C2 network patterns, and follow-on module execution.",
        "description": "Weigh the evidence from file access, network activity, and process execution to determine the likelihood of a REVSTEALER infection.",
        "max_iterations": 6,
        "expected_signal": "A per-host verdict citing specific indicators.",
        "success_criteria": "A per-host verdict of malicious, suspicious, or benign citing the specific rows found."
      },
      "parents": [
        {
          "id": "gaming-config-theft",
          "kind": "merge"
        },
        {
          "id": "c2-dns-resolutions",
          "kind": "merge"
        },
        {
          "id": "follow-on-modules",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the agent-triage verdict is malicious for at least one host based on overlapping file theft and C2 activity.",
        "condition": "the agent-triage verdict is malicious for at least one host based on overlapping file theft and C2 activity.",
        "blind_spot": "abe-bypass-monitoring",
        "confidence": "high",
        "description": "Halt data exfiltration by isolating confirmed malicious hosts.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "agent-triage"
        }
      ]
    },
    {
      "id": "isolate-host-and-revoke",
      "type": "action",
      "label": "Isolate host and revoke sessions",
      "config": {
        "target": "endpoint",
        "description": "Restrict the affected host from the network and force session invalidation to prevent further account takeover.",
        "instructions": "Isolate the host immediately via the endpoint agent. Force a password reset and session revocation for all potentially compromised accounts, including Steam, Battle.net, and Slack.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst review",
      "config": {
        "assignee": "analyst",
        "description": "Verify the agent findings and investigate potential lateral movement or persistent modules.",
        "instructions": "Review the cited rows from file and network activity. Check the environmental variables of the malicious process for sensitive tokens. Confirm if ProManager or XMRig modules were successfully executed."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host-and-revoke"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Document findings and assess if behavioral signals should be promoted to standing detections.",
        "instructions": "Record the findings, including any new contract addresses identified. If the gaming configuration access signal was high confidence, promote the 'gaming-config-theft' query to a standing rule."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-review"
        }
      ]
    }
  ]
}