REVSTEALER ramps up: analysis of up-and-coming infostealer

Elastic Security Labs details REVSTEALER (REF2859), an increasingly active infostealer distributed via social-engineered gaming lures and hijacked YouTube channels. The malware features comprehensive credential and wallet theft, gaming-platform targeting, anti-analysis techniques (sandbox scoring, CIS locale exclusions, VMProtect packing), Polygon-based smart-contract dead drops for fallback C2, and modular follow-on payloads (ProManager, WinUpdate, SoftManager, LockAppHost). The report includes sample hashes, C2 domains, Polygon contract addresses, detection guidance artifacts (YARA rules), and an IDAPython string-decryption tool for analysts.