REVSTEALER Modules Disable Windows Defender to Run Crypto Miner
Elastic Security Labs identified four REVSTEALER-associated programs that disable Windows Update and Defender to deploy a cryptocurrency miner, persisting even after the main stealer removes itself.