StealC/Amadey Infostealer Screenshot Capture via BitBlt in Temp Directory
Detects the creation of image files (JPEG, BMP, PNG) in temporary system directories by processes not associated with standard UI, browser, or imaging applications. This behavior is indicative of infostealer malware, such as StealC or Amadey, using GDI APIs like BitBlt or CreateCompatibleDC to capture desktop screenshots.
YARA-L
