Yuta/GloveStealer PyInstaller Runtime Unpacked from _MEI Temp Directory

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the execution of potential stealer malware (such as Yuta or Glove Stealer) packaged as a PyInstaller executable. The detection monitors for the characteristic behavior where the application unpacks its runtime environment into a _MEI* temporary directory and subsequently spawns child processes from that path, or utilizes specific naming conventions like 'winupdate.exe' within temporary or cache directories, common techniques for staging malicious payloads.