StealC Named Event Object Creation Using computername_username Victim ID Format

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects a process creating a Windows named event object that follows the specific naming convention of StealC malware (computer_name_username). This technique is used by the malware as an instance mutex to prevent multiple concurrent executions on the same host.