Yuta/Glove Stealer: .NET WPF Lure Staging PyInstaller Payload to AppData Cache

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects the creation or execution of files named 'winupdate.exe' and specific patterns of Python script execution within user-writable 'AppData' subdirectories, specifically targeting the '.cache' folder. This behavior is indicative of potential malware staging or execution, often associated with obfuscated payloads or unauthorized software running in non-standard user locations.