0. Preface The previous sample in this repository arrived labelled RustyStealer and turned out not to be a stealer at all — it was a hVNC remote access trojan calling itself Bridge Agent. This one arrived under the same label and is exactly what it says on the tin — which is worth stating plainly, because the two samples share a folder name, a language, and nothing else. Everything below is static analysis....

0. Preface This sample arrived in a folder named RustyStealer. It is written in Rust, but it is not a stealer, and saying so early matters: a responder who goes looking for dumped browser credentials will find none, and will walk straight past the hidden-desktop remote-control subsystem that is the actual point of the program. The label is not meaningless, though — it is misfiled. A second sample from the same folder is a Rust infostealer, with a working Chrome App-Bound Encryption bypass and a Telegram bot for exfiltration....

0. Preface This is a different sample from the one covered in the ClickFix ‘softmix-online’ writeup. That campaign ended in a Go payload obfuscated with garble. This one is a native C++ x64 build that self-reports version 3.1, and it protects itself very differently: no imports at all, and no strings stored anywhere in the file. Everything below is static analysis. The sample was never executed and no request was made to its C2 infrastructure....

Executive Summary This malware analysis documents a multi-stage Windows infostealer infection chain discovered via malware samples tracked on MalwareBazaar (softmix-online tag), submitted 4 July 2026. The campaign uses a fake software download site (softmix.online) that distributes a password-protected archive which is a technique specifically chosen to bypass automated security inspection. The attack unfolds through several layers of evasion (PowerShell downloader, encrypted archive, NSIS installer, and an Electron application) before executing the final payloads:...

1. Sample Information Original file name: chrome.exe File type: dynamic-link-library, 32-bit, GUI File size: 1.532784 MB Hash values: MD5: 817df56f4ad3a3f6b39765e5ed95501d SHA1: 15940bb4fa5e4d9b7a940dca3a1459d4216b1dbc SHA256: 216188ee52b067f761bdf3c456634ca2e84d278c8ebf35cd4cb686d45f5aaf7b Compile Timestamp: Thu Mar 20 08:18:00 2025 Packing/Obfusction: None File Entropy Details: Sections Entropy .text 5.565 .rdata 3.910 .data 5.865 .idata 4.492 .gfids 2.945 .tls 0.011 .00cfg 0.061 .rsrc 2.239 .reloc 6.275 2. PE File Structure Sections overview: Sections Virtual Size Raw Size .text 1197979 1198080 ....