MicroStealer NSIS Electron Java Chain Detection

Lacey Cochrane@NullVectorX

•updated Mar 16, 2026•2•0•321

This rule detects the execution chain associated with MicroStealer, specifically looking for processes named 'RocobeSetup.exe', 'Game Launcher.exe', or 'miicrosoft.exe' that are involved in actions related to a file named 'soft.jar'. This indicates the potential presence and activity of the MicroStealer malware.