UnixStealer Dropped Artifacts in %TEMP% (evo_* files, stolen.zip)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•4

Detects the creation of files in the Windows Temp directory that match specific naming patterns associated with UnixStealer, including tool executables, database files, stolen data archives, and debug logs. These artifacts are characteristic of the tool's staging and activity tracking behaviors.