BoldTealLayer Suspicious Process Execution Path

Ethan Andrews@eandrews

•updated Jun 2, 2026•1•0•12

Detects the execution of 'active_desktop_launcher.exe' (a legitimate signed KuGou binary) from unusual directories like ProgramData or AppData\Local\Temp. This behavior indicates potential DLL side-loading staging by the BoldTealLayer malware prior to executing its in-memory evasion chain.