KuinaExtractor Infostealer: Mutex, Debug File, and Build Alias Detection

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•3

Detects indicators of the KuinaExtractor infostealer, including specific named pipes/objects, the creation of a 'zenith_debug.txt' file in user profile directories, and the presence of build-related aliases ('kuina1999', 'k0to') in process command lines or file paths.