Yuta/Glove Stealer PyInstaller Temp Cleanup and Self-Deletion Post-Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•3

Detects post-execution cleanup activities associated with Yuta/Glove stealer, including the deletion of files in PyInstaller temp directories (_MEI*), temporary paths, and the removal of specific stealer components (e.g., YutaCore.dll, SLaunch.exe) via command-line utilities like cmd.exe or PowerShell.