Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Summary: Elastic Security Labs documented four previously unreported programs tied to the REVSTEALER infostealer that persist after the stealer deletes itself, publishing the findings on September 2. LockAppHost abuses the Windows CMSTP tool to gain administrator rights, then adds Microsoft Defender exclusions, disables 5 Windows Update services, 11 scheduled update tasks and 2 malware removal tasks, and hides a cryptocurrency miner within legitimate Windows processes.
Why it matters: The core stealer reports 'complete' and deletes itself, so an infection can look resolved while LockAppHost's disabled updates, Defender exclusions and hidden miner keep running - and Elastic's public YARA file has no rule for LockAppHost at all.

Read the original at The Hacker News ↗