Detecting REVSTEALER Activity and Automating File Removal With Wazuh

Oct 15, 2026 · Original article ↗

Summary

A Wazuh walkthrough demonstrates detecting REVSTEALER modules on Windows 11 using Sysmon, custom rules, and file integrity monitoring, with automated removal of files matching known malware hashes.

Key points

The walkthrough uses Wazuh 4.14.8 and an isolated Windows 11 endpoint to test four REVSTEALER modules without internet access.
Sysmon-based rules detect scheduled-task, service, and logon-script persistence, wallet-data staging, and suspicious executable locations.
LockAppHost detections cover nslookup.exe process hollowing, possible parent-process spoofing, Microsoft Defender exclusions, and Windows Update disabling.
CDB lists match known malware hashes and C2 domains; separate rules flag public Polygon RPC queries from executables in user-writable directories as possible fallback C2 lookups.
A correlation rule flags three or more REVSTEALER behavior alerts within three minutes for further investigation.
Real-time monitoring of Downloads folders triggers hash matching. Active Response rechecks the file hash before attempting deletion and generates success or failure alerts.

Article Details

Defense Focus: Detect REVSTEALER module installation, persistence, defense evasion, wallet-data staging, and C2 discovery on Windows endpoints, and remove files matching known malicious hashes.
Detection Methods: Match file SHA-256 hashes and DNS query names against CDB lists of known REVSTEALER artifacts and C2 domains.
Detect Defender exclusion commands, Windows Update policy changes, disabled update services and tasks, and deletion of update-service registry keys.
Identify processes running as SYSTEM with explorer.exe as the reported parent, nslookup.exe image replacement, and unusual DNS queries or child processes originating from nslookup.exe.
Detect minute-based scheduled tasks executing from AppData, known module task-name patterns, services executing from ProgramData, and UserInitMprLogonScript changes.
Detect executable creation in hexadecimal-named ProgramData directories and wallet-data staging beneath temporary dat-prefixed directories containing a literal %APPDATA% folder.
Correlate three or more REVSTEALER behavior alerts within 180 seconds.
Flag public Polygon RPC DNS queries from executables in user-writable directories as possible fallback C2 discovery; these public endpoints are not themselves identified as malicious.
Use real-time file integrity monitoring to detect known samples copied into monitored Downloads directories, even without execution.
Generate separate alerts for successful and failed automated file removal.
Data Sources: Microsoft-Windows-Sysmon/Operational event channel.
Sysmon process creation events, including command lines, parent images, and logon IDs.
Sysmon file creation, registry value modification, DNS query, and process-tampering events.
File integrity monitoring events containing file paths and SHA-256 hashes.
Active Response logs reporting file-removal outcomes.
Rule Types: Custom XML detection rules using PCRE2 field matching.
CDB match_key lookups for hashes and DNS query names.
Frequency-based behavioral correlation rules.
Dashboard searches and rule-ID filters.
Active Response outcome rules matching success and error messages.
Defensive Actions: Forward endpoint Sysmon events to the analysis server and include Windows Update policy registry paths in collection.
Enable real-time monitoring of C:\Users\*\Downloads and load the supplied malicious-hash and C2-domain lists.
Configure rule 117319 to trigger endpoint-local removal of files matching known REVSTEALER hashes.
Before deletion, recompute the file SHA-256 and require it to match the hash in the triggering alert.
Review removal-success and removal-failure alerts and investigate correlated behavioral detections.
Conduct sample testing only in an isolated, disposable virtual machine and restore a clean snapshot afterward.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`config[.]hubdisplay[.]lol`	ProManager C2 domain queried by the module in the isolated lab.
DOMAIN	`health[.]journal-metric[.]lol`	WinUpdate C2 domain queried by the module in the isolated lab.
DOMAIN	`metric[.]gardenpark[.]click`	SoftManager C2 domain queried by the module in the isolated lab.
DOMAIN	`monitor5[.]roast-core85[.]click`	Listed REVSTEALER C2 domain included in the malicious-domain detection list.
DOMAIN	`polygon[.]iwmukj[.]xyz`	Listed REVSTEALER C2 domain included in the malicious-domain detection list.
SHA256	`13d7237d7289e67c2d806a65d52580b453ce4987acbe2c4c4d04833f55ebccfa`	Analyzed ProManager malicious module sample used for hash-based detection and removal.
SHA256	`14b2ac356ed75d10ef40bbaaa48e7dd9fff7de9719c2a43ad123fe843dd4e4e2`	Analyzed SoftManager malicious module sample used for hash-based detection and removal.
SHA256	`7c08cf409194056a8517865e5d3433d1499bb8262263b55b49b8b07d9d182fcb`	Analyzed WinUpdate malicious module sample used for hash-based detection and removal.
SHA256	`c66d2b77b9e85c53391891212413ad9a99eb66f4b11c6a431e78884a5b2651e5`	Analyzed LockAppHost malicious module sample used for hash-based detection and removal.