Yuta WPF Dropper (SLaunch.exe) Staging PyInstaller Stealer to AppData Cache

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

Detects the Yuta .NET WPF dropper (SLaunch.exe) executing and subsequently creating a secondary payload (winupdate.exe) within the AppData\Roaming\.cache directory. This pattern is characteristic of the Yuta/Glove Stealer infection chain where a dropper masquerading as a UI component stages a PyInstaller-compiled stealer binary.