Yuta Glove Stealer Sandbox Evasion via VM Registry Artifact Query (winupdate.exe)
Detects the Yuta/Glove Stealer malware (winupdate.exe) performing environment checks by querying Windows registry keys associated with virtualization software (VMware, VirtualBox, QEMU). This behavior is indicative of sandbox evasion techniques used to detect analysis environments before executing secondary payloads.
YARA-L
