Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Elastic Security Labs has identified four previously unknown modules linked to the REVSTEALER Windows information stealer. These modules remain on a compromised machine even after REVSTEALER removes itself. One of these modules is capable of disabling Windows Update and Microsoft Defender, and then proceeds to run a cryptocurrency miner. The four modules have been named ProManager, WinUpdate, SoftManager, and another unnamed module. They are associated with the REVSTEALER malware, which is a type of Windows information stealer. The modules' ability to disable security features allows them to operate without interruption.