Yuta/Glove Stealer Sandbox VM Evasion Registry Check from winupdate.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the Glove Stealer (Yuta) payload, identified as winupdate.exe, performing registry queries for virtual machine artifacts such as VMware, VirtualBox, or QEMU strings. This is a common sandbox evasion technique to determine if the malware is running in an analysis environment.