Turla STOCKSTAY STOCKTRADER ZIP Archive Creation from LOCALAPPDATA SMN Path

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•4

Detects the creation of ZIP/RAR/7z archives by processes residing within the Turla STOCKSTAY installation directory (%LOCALAPPDATA%\Programs\SMN\) or by known STOCKSTAY malicious components. This behavior is associated with the STOCKSTAY 'Get' command, which gathers files and archives them in-memory for base64-encoded exfiltration.