Yuta/Glove Stealer Sandbox VM Evasion Registry Check from winupdate.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•8

Detects the Yuta/Glove stealer malware performing sandbox and virtualization environment evasion. The rule specifically monitors for the process 'winupdate.exe' attempting to query common registry keys associated with virtualization software (VMware, VirtualBox, VBOX, QEMU) and executing WMI commands to enumerate system manufacturer information via 'wmic.exe'. These actions are commonly used by malware to detect if it is executing within an analysis sandbox or VM to abort or alter its behavior.