SharkLoader MinHook/Detours API Hook Artifacts - SyncRes.dat Drop and .dat ImageLoad

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•6

Detects artifacts associated with the SharkLoader malware, specifically the dropping of suspicious .dat and .mui files in AppData staging directories (e.g., xwreg, xgdf) and the subsequent loading of these files as executable modules. This behavior is indicative of MinHook or Detours-based API hooking used for EDR evasion.