highMalware
REVSTEALER Associated Modules Disable Windows Update and Defender for Crypto Mining
Elastic Security Labs has documented four previously unreported programs associated with REVSTEALER, a Windows information stealer. One of these modules, ProManager, disables Windows Update and Microsoft Defender before executing a cryptocurrency miner. The modules remain on the machine after the stealer deletes itself, providing persistent access for malicious activities.
The Hacker News1 min read