Elastic finds four REVSTEALER companion modules that persist after the stealer deletes itself, including one that mines crypto.