SharkLoader Registry Run Key Persistence with File Creation Correlation

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects potential SharkLoader persistence mechanisms where a registry 'Run' key is modified to execute a file located in AppData or ProgramData, or containing a base64-encoded command. The detection correlates the registry modification with a recent file creation event of the referenced file in the same directory paths on the same host.