Tuglainsaatci Run Key Appdata Roaming Exe Persistence

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•2

Detects HKCU/HKLM Run key write whose registry_value_data points to an executable under AppData\Roaming, correlated with a FILE_CREATION of that executable on the same host within 5 minutes. Consistent with the TuglaInsaatci steganographic loader dropping a randomly-named copy of itself (e.g. dEprjIuLKcEd.exe) to AppData\Roaming and registering it for autorun.