Yuta/Glove Stealer WPF Lure Staging PyInstaller Payload (winupdate.exe)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects the execution and creation of suspicious files named 'winupdate.exe' or 'SLaunch.exe' within the AppData cache directory, or processes involving 'YutaCore.dll' or a specific local host URL. It also checks for the execution of known malicious file hashes associated with this behavior.