STOCKSTAY Environmental Keying: WMI System Survey then LOCALAPPDATA Component Load

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects evidence of Turla STOCKSTAY malware performing environmental keying via WMI system discovery (collecting OSVersion, MachineName, and UserName) followed by the execution of components from the specific %LOCALAPPDATA%\Programs\SMN\ directory. This behavior suggests the malware is using system-specific attributes to decrypt configuration or verify the environment before proceeding.