Yuta WPF Dropper Staging PyInstaller Stealer to APPDATA Cache
Detects the Yuta/Solara .NET WPF dropper (SLaunch.exe) executing the staging phase of a PyInstaller-compiled Python stealer (winupdate.exe) into the %APPDATA%\.cache directory, as observed in the Glove Stealer campaign.
YARA-L
